diff --git a/Mk/Uses/qt.mk b/Mk/Uses/qt.mk index 42fb1dbba3df..a5d832c65a3d 100644 --- a/Mk/Uses/qt.mk +++ b/Mk/Uses/qt.mk @@ -23,7 +23,7 @@ _QT_MK_INCLUDED= qt.mk # Qt versions currently supported by the framework. _QT_SUPPORTED?= 5 6 QT5_VERSION?= 5.15.13 -QT6_VERSION?= 6.7.0 +QT6_VERSION?= 6.7.1 PYSIDE6_VERSION?= 6.7.0 # Support for intermediate Qt6 releases. This partially defines diff --git a/accessibility/qt6-speech/distinfo b/accessibility/qt6-speech/distinfo index 17cd21daf010..c41ea74e6507 100644 --- a/accessibility/qt6-speech/distinfo +++ b/accessibility/qt6-speech/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112642 -SHA256 (KDE/Qt/6.7.0/qtspeech-everywhere-src-6.7.0.tar.xz) = 44768eba837d48c2233ef12aab562acf2d3c531b489f4ec70124e2bb313d1f11 -SIZE (KDE/Qt/6.7.0/qtspeech-everywhere-src-6.7.0.tar.xz) = 261732 +TIMESTAMP = 1716399184 +SHA256 (KDE/Qt/6.7.1/qtspeech-everywhere-src-6.7.1.tar.xz) = 6c6f1d15c8fc0ef5cb0cfc401a07ecc56e34f1e8510126383cef658cf751eb88 +SIZE (KDE/Qt/6.7.1/qtspeech-everywhere-src-6.7.1.tar.xz) = 261772 diff --git a/comms/qt6-connectivity/distinfo b/comms/qt6-connectivity/distinfo index 4188bd25b5c7..226809578af5 100644 --- a/comms/qt6-connectivity/distinfo +++ b/comms/qt6-connectivity/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112647 -SHA256 (KDE/Qt/6.7.0/qtconnectivity-everywhere-src-6.7.0.tar.xz) = 07afd6aac19ff73c8ba1471057f43d4ef2737d6a8a772393ec907988dd71244c -SIZE (KDE/Qt/6.7.0/qtconnectivity-everywhere-src-6.7.0.tar.xz) = 1060904 +TIMESTAMP = 1716399187 +SHA256 (KDE/Qt/6.7.1/qtconnectivity-everywhere-src-6.7.1.tar.xz) = 70010afbe442bd41c9d4aad85d80fe0a8f2cbcf01cef3f3d88196e5520a73dcb +SIZE (KDE/Qt/6.7.1/qtconnectivity-everywhere-src-6.7.1.tar.xz) = 1061900 diff --git a/comms/qt6-sensors/distinfo b/comms/qt6-sensors/distinfo index 6a17740fe87b..1cfbbbae1a0a 100644 --- a/comms/qt6-sensors/distinfo +++ b/comms/qt6-sensors/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112654 -SHA256 (KDE/Qt/6.7.0/qtsensors-everywhere-src-6.7.0.tar.xz) = 1c3015200a30a64f760818e40794df719e068fc25179e96e88993dff38f7bcab -SIZE (KDE/Qt/6.7.0/qtsensors-everywhere-src-6.7.0.tar.xz) = 1494212 +TIMESTAMP = 1716399192 +SHA256 (KDE/Qt/6.7.1/qtsensors-everywhere-src-6.7.1.tar.xz) = d5694a17d90f71039c12daf9c1c14fd76baf447246798e7cad171038c80dfbf2 +SIZE (KDE/Qt/6.7.1/qtsensors-everywhere-src-6.7.1.tar.xz) = 1494588 diff --git a/comms/qt6-serialbus/distinfo b/comms/qt6-serialbus/distinfo index ee7aaa2966d0..bdd7f24407c3 100644 --- a/comms/qt6-serialbus/distinfo +++ b/comms/qt6-serialbus/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112659 -SHA256 (KDE/Qt/6.7.0/qtserialbus-everywhere-src-6.7.0.tar.xz) = 498193a9860664f8a55f676656c45af179ac13d48184af43fc58ddf795bb76dd -SIZE (KDE/Qt/6.7.0/qtserialbus-everywhere-src-6.7.0.tar.xz) = 546788 +TIMESTAMP = 1716399194 +SHA256 (KDE/Qt/6.7.1/qtserialbus-everywhere-src-6.7.1.tar.xz) = 513905d545b81b040fc9d7a996aa2d6fa310048c36b24919a973f2a6a555628f +SIZE (KDE/Qt/6.7.1/qtserialbus-everywhere-src-6.7.1.tar.xz) = 547732 diff --git a/comms/qt6-serialport/distinfo b/comms/qt6-serialport/distinfo index f4f5afe8a382..58236d660abb 100644 --- a/comms/qt6-serialport/distinfo +++ b/comms/qt6-serialport/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112663 -SHA256 (KDE/Qt/6.7.0/qtserialport-everywhere-src-6.7.0.tar.xz) = b1f02a3d8c9cc8ba2ffa7cca3749f1f147d327e8dfc633fd4ec3cb770d7981c9 -SIZE (KDE/Qt/6.7.0/qtserialport-everywhere-src-6.7.0.tar.xz) = 270604 +TIMESTAMP = 1716399197 +SHA256 (KDE/Qt/6.7.1/qtserialport-everywhere-src-6.7.1.tar.xz) = e543a3788bfd522f2e4a111ba568214f1f5be6e55f08318c2dcd376124ea5886 +SIZE (KDE/Qt/6.7.1/qtserialport-everywhere-src-6.7.1.tar.xz) = 271220 diff --git a/databases/qt6-base_sqldriver/Makefile b/databases/qt6-base_sqldriver/Makefile index fc30996a3275..b7f4abfe8308 100644 --- a/databases/qt6-base_sqldriver/Makefile +++ b/databases/qt6-base_sqldriver/Makefile @@ -30,8 +30,4 @@ sqlite_USES= sqlite:3 sqlite_CMAKE_ON= QT_FEATURE_system_sqlite ${FLAVOR}_PLIST= ${.CURDIR}/pkg-plist.${FLAVOR} -.if ${FLAVOR:U} == mysql -IGNORE_WITH_MYSQL= 105m 106m 1011m -.endif - .include diff --git a/databases/qt6-base_sqldriver/distinfo b/databases/qt6-base_sqldriver/distinfo index 3000c6da2c25..3717031f8d99 100644 --- a/databases/qt6-base_sqldriver/distinfo +++ b/databases/qt6-base_sqldriver/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112752 -SHA256 (KDE/Qt/6.7.0/qtbase-everywhere-src-6.7.0.tar.xz) = 11b2e29e2e52fb0e3b453ea13bbe51a10fdff36e1c192d8868c5a40233b8b254 -SIZE (KDE/Qt/6.7.0/qtbase-everywhere-src-6.7.0.tar.xz) = 49314276 +TIMESTAMP = 1716399242 +SHA256 (KDE/Qt/6.7.1/qtbase-everywhere-src-6.7.1.tar.xz) = b7338da1bdccb4d861e714efffaa83f174dfe37e194916bfd7ec82279a6ace19 +SIZE (KDE/Qt/6.7.1/qtbase-everywhere-src-6.7.1.tar.xz) = 49324536 diff --git a/devel/qt6-5compat/distinfo b/devel/qt6-5compat/distinfo index 06a74a6ace18..47888f3261db 100644 --- a/devel/qt6-5compat/distinfo +++ b/devel/qt6-5compat/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112788 -SHA256 (KDE/Qt/6.7.0/qt5compat-everywhere-src-6.7.0.tar.xz) = 9d49d4fd8345d8a40b63e0b65cd49c1d8286e33a7f1409bf1316763f654e19f5 -SIZE (KDE/Qt/6.7.0/qt5compat-everywhere-src-6.7.0.tar.xz) = 14629204 +TIMESTAMP = 1716399259 +SHA256 (KDE/Qt/6.7.1/qt5compat-everywhere-src-6.7.1.tar.xz) = 41c4bbe419158fc170ee3ef3ecffead506e70802109deec036d86e4244086009 +SIZE (KDE/Qt/6.7.1/qt5compat-everywhere-src-6.7.1.tar.xz) = 14631152 diff --git a/devel/qt6-base/Makefile b/devel/qt6-base/Makefile index d1ac58883186..3f62825bb99f 100644 --- a/devel/qt6-base/Makefile +++ b/devel/qt6-base/Makefile @@ -3,9 +3,6 @@ DISTVERSION= ${QT6_VERSION} CATEGORIES= devel PKGNAMEPREFIX= qt6- -PATCH_SITES= https://github.com/qt/qtbase/commit/ -PATCHFILES+= 7c4e1357e49baebdd2d20710fccb5604cbb36c0d.patch:-p1 # CVE-2024-33861 - MAINTAINER= kde@FreeBSD.org COMMENT= Qt base (core, gui, widgets, network,...) diff --git a/devel/qt6-base/distinfo b/devel/qt6-base/distinfo index 8fc9397acc46..bc49ba01be51 100644 --- a/devel/qt6-base/distinfo +++ b/devel/qt6-base/distinfo @@ -1,5 +1,3 @@ -TIMESTAMP = 1715748396 -SHA256 (KDE/Qt/6.7.0/qtbase-everywhere-src-6.7.0.tar.xz) = 11b2e29e2e52fb0e3b453ea13bbe51a10fdff36e1c192d8868c5a40233b8b254 -SIZE (KDE/Qt/6.7.0/qtbase-everywhere-src-6.7.0.tar.xz) = 49314276 -SHA256 (KDE/Qt/6.7.0/7c4e1357e49baebdd2d20710fccb5604cbb36c0d.patch) = fa921cb0eb73ed23a0a5c6cfaf10da2116511b60f2e49c8c406eef516363d228 -SIZE (KDE/Qt/6.7.0/7c4e1357e49baebdd2d20710fccb5604cbb36c0d.patch) = 6164 +TIMESTAMP = 1716401147 +SHA256 (KDE/Qt/6.7.1/qtbase-everywhere-src-6.7.1.tar.xz) = b7338da1bdccb4d861e714efffaa83f174dfe37e194916bfd7ec82279a6ace19 +SIZE (KDE/Qt/6.7.1/qtbase-everywhere-src-6.7.1.tar.xz) = 49324536 diff --git a/devel/qt6-base/files/patch-cmake_FindMySQL.cmake b/devel/qt6-base/files/patch-cmake_FindMySQL.cmake new file mode 100644 index 000000000000..3d94148a38ae --- /dev/null +++ b/devel/qt6-base/files/patch-cmake_FindMySQL.cmake @@ -0,0 +1,13 @@ +Use pkgconf to set hints for MariaDB, as well. + +--- cmake/FindMySQL.cmake.orig 2024-05-08 09:42:08 UTC ++++ cmake/FindMySQL.cmake +@@ -43,7 +43,7 @@ if(PkgConfig_FOUND AND NOT DEFINED MySQL_ROOT) + find_package(PkgConfig QUIET) + endif() + if(PkgConfig_FOUND AND NOT DEFINED MySQL_ROOT) +- pkg_check_modules(PC_MySQL QUIET "mysqlclient") ++ pkg_search_module(PC_MySQL QUIET "libmariadb" "mysqlclient") + set(MySQL_include_dir_hints ${PC_MySQL_INCLUDEDIR}) + set(MySQL_library_hints ${PC_MySQL_LIBDIR}) + set(MySQL_library_hints_debug "") diff --git a/devel/qt6-base/files/patch-src_corelib_tools_qspan.h b/devel/qt6-base/files/patch-src_corelib_tools_qspan.h deleted file mode 100644 index 287d7ae418f0..000000000000 --- a/devel/qt6-base/files/patch-src_corelib_tools_qspan.h +++ /dev/null @@ -1,15 +0,0 @@ -Fix warning which causes error in www/dooble due to -Werror being set. - -/usr/local/include/qt6/QtCore/qspan.h:278:5: error: '__cpp_lib_span' is not defined, evaluates to 0 - ---- src/corelib/tools/qspan.h.orig 2024-01-22 10:20:09 UTC -+++ src/corelib/tools/qspan.h -@@ -275,7 +275,7 @@ class QSpanBase : protected QS - : QSpanBase(other.data(), other.size()) - {} - --#if __cpp_lib_span -+#ifdef __cpp_lib_span - template = true> - Q_IMPLICIT constexpr QSpanBase(std::span other) noexcept - : QSpanBase(other.data(), other.size()) diff --git a/devel/qt6-base/pkg-plist b/devel/qt6-base/pkg-plist index 4f219c9874f8..8ebb068d2b74 100644 --- a/devel/qt6-base/pkg-plist +++ b/devel/qt6-base/pkg-plist @@ -1659,6 +1659,7 @@ bin/qmake6 %%QT_INCDIR%%/QtNetwork/QNetworkRequestFactory %%QT_INCDIR%%/QtNetwork/QOcspResponse %%QT_INCDIR%%/QtNetwork/QPasswordDigestor +%%QT_INCDIR%%/QtNetwork/QRestAccessManager %%QT_INCDIR%%/QtNetwork/QRestReply %%QT_INCDIR%%/QtNetwork/QSsl %%QT_INCDIR%%/QtNetwork/QSslCertificate @@ -3104,8 +3105,8 @@ lib/cmake/Qt6Xml/Qt6XmlVersionlessTargets.cmake %%QT_LIBDIR%%/metatypes/qt6widgets_%%CMAKE_BUILD_TYPE%%_metatypes.json %%X11%%%%QT_LIBDIR%%/metatypes/qt6xcbqpaprivate_%%CMAKE_BUILD_TYPE%%_metatypes.json %%QT_LIBDIR%%/metatypes/qt6xml_%%CMAKE_BUILD_TYPE%%_metatypes.json -%%DEBUG%%%%QT_LIBDIR%%/objects-Debug/ExampleIconsPrivate_resources_1/.rcc/qrc_example_icons_init.cpp.o -%%NO_DEBUG%%%%QT_LIBDIR%%/objects-Release/ExampleIconsPrivate_resources_1/.rcc/qrc_example_icons_init.cpp.o +%%DEBUG%%%%QT_LIBDIR%%/objects-Debug/ExampleIconsPrivate_resources_1/.qt/rcc/qrc_example_icons_init.cpp.o +%%NO_DEBUG%%%%QT_LIBDIR%%/objects-Release/ExampleIconsPrivate_resources_1/.qt/rcc/qrc_example_icons_init.cpp.o %%QT_MKSPECDIR%%/aix-g++-64/qmake.conf %%QT_MKSPECDIR%%/aix-g++-64/qplatformdefs.h %%QT_MKSPECDIR%%/aix-g++/qmake.conf @@ -3621,6 +3622,7 @@ libdata/pkgconfig/Qt6Xml.pc %%QT_TOOLDIR%%/qt-cmake-private %%QT_TOOLDIR%%/qt-cmake-private-install.cmake %%QT_TOOLDIR%%/qt-cmake-standalone-test +%%QT_TOOLDIR%%/qt-internal-configure-examples %%QT_TOOLDIR%%/qt-internal-configure-tests %%QT_TOOLDIR%%/qt-testrunner.py %%QT_TOOLDIR%%/qvkgen diff --git a/devel/qt6-languageserver/distinfo b/devel/qt6-languageserver/distinfo index 7ae1f34fbcd7..d8f202ac0ff0 100644 --- a/devel/qt6-languageserver/distinfo +++ b/devel/qt6-languageserver/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112792 -SHA256 (KDE/Qt/6.7.0/qtlanguageserver-everywhere-src-6.7.0.tar.xz) = a99ecb342abdf7b7ac24804c89830a7991de95f9402f45a1e337ae851f76c9fc -SIZE (KDE/Qt/6.7.0/qtlanguageserver-everywhere-src-6.7.0.tar.xz) = 145140 +TIMESTAMP = 1716399262 +SHA256 (KDE/Qt/6.7.1/qtlanguageserver-everywhere-src-6.7.1.tar.xz) = a0fcda1464760e10d9d78d4260e78c94f7ef51343193d8fd2cfef991a4fa94f9 +SIZE (KDE/Qt/6.7.1/qtlanguageserver-everywhere-src-6.7.1.tar.xz) = 145728 diff --git a/devel/qt6-location/distinfo b/devel/qt6-location/distinfo index a363028bbebd..dd200b9c539f 100644 --- a/devel/qt6-location/distinfo +++ b/devel/qt6-location/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112799 -SHA256 (KDE/Qt/6.7.0/qtlocation-everywhere-src-6.7.0.tar.xz) = bb044d66bc17db98f526ec1b52d8e94810e046310f288561380774e5903ad46a -SIZE (KDE/Qt/6.7.0/qtlocation-everywhere-src-6.7.0.tar.xz) = 3165588 +TIMESTAMP = 1716399321 +SHA256 (KDE/Qt/6.7.1/qtlocation-everywhere-src-6.7.1.tar.xz) = 3870178c2ec9fda35f823ad24f3b883b70ec082a6a496eeb2d1fbd57b6268608 +SIZE (KDE/Qt/6.7.1/qtlocation-everywhere-src-6.7.1.tar.xz) = 3166636 diff --git a/devel/qt6-positioning/distinfo b/devel/qt6-positioning/distinfo index 1f0ecbd8b816..3c157b2b8741 100644 --- a/devel/qt6-positioning/distinfo +++ b/devel/qt6-positioning/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112802 -SHA256 (KDE/Qt/6.7.0/qtpositioning-everywhere-src-6.7.0.tar.xz) = 1d601ba43c26c8a01db81eeaaeea5943c015da98caa59d7905b86e0e9d609ddf -SIZE (KDE/Qt/6.7.0/qtpositioning-everywhere-src-6.7.0.tar.xz) = 658368 +TIMESTAMP = 1716399324 +SHA256 (KDE/Qt/6.7.1/qtpositioning-everywhere-src-6.7.1.tar.xz) = 5c2b0d46b8d35126e97c8efe22264b2de7ac1273a5ec38a0314731bb02804f53 +SIZE (KDE/Qt/6.7.1/qtpositioning-everywhere-src-6.7.1.tar.xz) = 658028 diff --git a/devel/qt6-remoteobjects/distinfo b/devel/qt6-remoteobjects/distinfo index f06927cb6b8d..26db6642c3bb 100644 --- a/devel/qt6-remoteobjects/distinfo +++ b/devel/qt6-remoteobjects/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112805 -SHA256 (KDE/Qt/6.7.0/qtremoteobjects-everywhere-src-6.7.0.tar.xz) = a0ba60d625c9713fc8396b8db1e283df863bfaa06664d46496bd16fab5e4c695 -SIZE (KDE/Qt/6.7.0/qtremoteobjects-everywhere-src-6.7.0.tar.xz) = 536264 +TIMESTAMP = 1716399328 +SHA256 (KDE/Qt/6.7.1/qtremoteobjects-everywhere-src-6.7.1.tar.xz) = e7012b01baf854d699dd588de14ce2b36487b329096c7a9b5048b43e7949ccf4 +SIZE (KDE/Qt/6.7.1/qtremoteobjects-everywhere-src-6.7.1.tar.xz) = 537016 diff --git a/devel/qt6-scxml/distinfo b/devel/qt6-scxml/distinfo index 842029d3e219..5d7f579ba434 100644 --- a/devel/qt6-scxml/distinfo +++ b/devel/qt6-scxml/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112809 -SHA256 (KDE/Qt/6.7.0/qtscxml-everywhere-src-6.7.0.tar.xz) = 725b97bbb8766df733d7588488acd92375c218eeb376a95525572b4268a9257c -SIZE (KDE/Qt/6.7.0/qtscxml-everywhere-src-6.7.0.tar.xz) = 1167668 +TIMESTAMP = 1716399333 +SHA256 (KDE/Qt/6.7.1/qtscxml-everywhere-src-6.7.1.tar.xz) = 022d415284e889bd6687ea57f91853a12e39f254bc8f125ecee6a19b5167b24f +SIZE (KDE/Qt/6.7.1/qtscxml-everywhere-src-6.7.1.tar.xz) = 1168276 diff --git a/devel/qt6-tools/distinfo b/devel/qt6-tools/distinfo index 54c942e02bfc..f46e82ad4d4b 100644 --- a/devel/qt6-tools/distinfo +++ b/devel/qt6-tools/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112826 -SHA256 (KDE/Qt/6.7.0/qttools-everywhere-src-6.7.0.tar.xz) = c8da6b239e82fe1e23465cbf0936c0da5a334438d3fb433e19c503cbb1abee7b -SIZE (KDE/Qt/6.7.0/qttools-everywhere-src-6.7.0.tar.xz) = 9012572 +TIMESTAMP = 1716399345 +SHA256 (KDE/Qt/6.7.1/qttools-everywhere-src-6.7.1.tar.xz) = 0953cddf6248f3959279a10904892e8a98eb3e463d729a174b6fc47febd99824 +SIZE (KDE/Qt/6.7.1/qttools-everywhere-src-6.7.1.tar.xz) = 9016376 diff --git a/devel/qt6-translations/distinfo b/devel/qt6-translations/distinfo index 9c9b6208e8c7..997c8512cee5 100644 --- a/devel/qt6-translations/distinfo +++ b/devel/qt6-translations/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712112830 -SHA256 (KDE/Qt/6.7.0/qttranslations-everywhere-src-6.7.0.tar.xz) = 26fc8047062ca4bacd1bd953be86fd39c6e0a5f5e9920c72ba9d40876cea4b56 -SIZE (KDE/Qt/6.7.0/qttranslations-everywhere-src-6.7.0.tar.xz) = 1475980 +TIMESTAMP = 1716399350 +SHA256 (KDE/Qt/6.7.1/qttranslations-everywhere-src-6.7.1.tar.xz) = 03d71565872b0e0e7303349071df031ab0f922f6dbdd3a5ec1ade9e188e4fbf4 +SIZE (KDE/Qt/6.7.1/qttranslations-everywhere-src-6.7.1.tar.xz) = 1547716 diff --git a/devel/qt6-translations/pkg-plist b/devel/qt6-translations/pkg-plist index b59afb032346..13bdb38c5227 100644 --- a/devel/qt6-translations/pkg-plist +++ b/devel/qt6-translations/pkg-plist @@ -9,6 +9,7 @@ %%QT_L10NDIR%%/assistant_hr.qm %%QT_L10NDIR%%/assistant_hu.qm %%QT_L10NDIR%%/assistant_ja.qm +%%QT_L10NDIR%%/assistant_ka.qm %%QT_L10NDIR%%/assistant_ko.qm %%QT_L10NDIR%%/assistant_nl.qm %%QT_L10NDIR%%/assistant_pl.qm @@ -32,6 +33,7 @@ %%QT_L10NDIR%%/designer_hr.qm %%QT_L10NDIR%%/designer_hu.qm %%QT_L10NDIR%%/designer_ja.qm +%%QT_L10NDIR%%/designer_ka.qm %%QT_L10NDIR%%/designer_ko.qm %%QT_L10NDIR%%/designer_nl.qm %%QT_L10NDIR%%/designer_pl.qm @@ -54,6 +56,7 @@ %%QT_L10NDIR%%/linguist_hu.qm %%QT_L10NDIR%%/linguist_it.qm %%QT_L10NDIR%%/linguist_ja.qm +%%QT_L10NDIR%%/linguist_ka.qm %%QT_L10NDIR%%/linguist_ko.qm %%QT_L10NDIR%%/linguist_nl.qm %%QT_L10NDIR%%/linguist_pl.qm @@ -93,6 +96,7 @@ %%QT_L10NDIR%%/qt_help_hu.qm %%QT_L10NDIR%%/qt_help_it.qm %%QT_L10NDIR%%/qt_help_ja.qm +%%QT_L10NDIR%%/qt_help_ka.qm %%QT_L10NDIR%%/qt_help_ko.qm %%QT_L10NDIR%%/qt_help_nl.qm %%QT_L10NDIR%%/qt_help_nn.qm @@ -109,6 +113,7 @@ %%QT_L10NDIR%%/qt_hu.qm %%QT_L10NDIR%%/qt_it.qm %%QT_L10NDIR%%/qt_ja.qm +%%QT_L10NDIR%%/qt_ka.qm %%QT_L10NDIR%%/qt_ko.qm %%QT_L10NDIR%%/qt_lt.qm %%QT_L10NDIR%%/qt_lv.qm @@ -142,6 +147,7 @@ %%QT_L10NDIR%%/qtbase_hu.qm %%QT_L10NDIR%%/qtbase_it.qm %%QT_L10NDIR%%/qtbase_ja.qm +%%QT_L10NDIR%%/qtbase_ka.qm %%QT_L10NDIR%%/qtbase_ko.qm %%QT_L10NDIR%%/qtbase_lv.qm %%QT_L10NDIR%%/qtbase_nl.qm @@ -162,6 +168,7 @@ %%QT_L10NDIR%%/qtconnectivity_es.qm %%QT_L10NDIR%%/qtconnectivity_hr.qm %%QT_L10NDIR%%/qtconnectivity_hu.qm +%%QT_L10NDIR%%/qtconnectivity_ka.qm %%QT_L10NDIR%%/qtconnectivity_ko.qm %%QT_L10NDIR%%/qtconnectivity_nl.qm %%QT_L10NDIR%%/qtconnectivity_pl.qm @@ -183,6 +190,7 @@ %%QT_L10NDIR%%/qtdeclarative_hr.qm %%QT_L10NDIR%%/qtdeclarative_hu.qm %%QT_L10NDIR%%/qtdeclarative_ja.qm +%%QT_L10NDIR%%/qtdeclarative_ka.qm %%QT_L10NDIR%%/qtdeclarative_ko.qm %%QT_L10NDIR%%/qtdeclarative_lv.qm %%QT_L10NDIR%%/qtdeclarative_nl.qm @@ -205,6 +213,7 @@ %%QT_L10NDIR%%/qtlocation_fr.qm %%QT_L10NDIR%%/qtlocation_hr.qm %%QT_L10NDIR%%/qtlocation_hu.qm +%%QT_L10NDIR%%/qtlocation_ka.qm %%QT_L10NDIR%%/qtlocation_ko.qm %%QT_L10NDIR%%/qtlocation_nl.qm %%QT_L10NDIR%%/qtlocation_pl.qm @@ -228,6 +237,7 @@ %%QT_L10NDIR%%/qtmultimedia_hu.qm %%QT_L10NDIR%%/qtmultimedia_it.qm %%QT_L10NDIR%%/qtmultimedia_ja.qm +%%QT_L10NDIR%%/qtmultimedia_ka.qm %%QT_L10NDIR%%/qtmultimedia_ko.qm %%QT_L10NDIR%%/qtmultimedia_nl.qm %%QT_L10NDIR%%/qtmultimedia_nn.qm @@ -243,6 +253,7 @@ %%QT_L10NDIR%%/qtserialport_en.qm %%QT_L10NDIR%%/qtserialport_es.qm %%QT_L10NDIR%%/qtserialport_ja.qm +%%QT_L10NDIR%%/qtserialport_ka.qm %%QT_L10NDIR%%/qtserialport_ko.qm %%QT_L10NDIR%%/qtserialport_pl.qm %%QT_L10NDIR%%/qtserialport_ru.qm @@ -252,6 +263,7 @@ %%QT_L10NDIR%%/qtwebengine_de.qm %%QT_L10NDIR%%/qtwebengine_en.qm %%QT_L10NDIR%%/qtwebengine_es.qm +%%QT_L10NDIR%%/qtwebengine_ka.qm %%QT_L10NDIR%%/qtwebengine_ko.qm %%QT_L10NDIR%%/qtwebengine_pl.qm %%QT_L10NDIR%%/qtwebengine_ru.qm @@ -263,7 +275,9 @@ %%QT_L10NDIR%%/qtwebsockets_es.qm %%QT_L10NDIR%%/qtwebsockets_fr.qm %%QT_L10NDIR%%/qtwebsockets_ja.qm +%%QT_L10NDIR%%/qtwebsockets_ka.qm %%QT_L10NDIR%%/qtwebsockets_ko.qm %%QT_L10NDIR%%/qtwebsockets_pl.qm %%QT_L10NDIR%%/qtwebsockets_ru.qm %%QT_L10NDIR%%/qtwebsockets_uk.qm +%%QT_L10NDIR%%/qtwebsockets_zh_CN.qm diff --git a/graphics/qt6-3d/distinfo b/graphics/qt6-3d/distinfo index 729c6c0cddc2..4f4fbf26e515 100644 --- a/graphics/qt6-3d/distinfo +++ b/graphics/qt6-3d/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712113036 -SHA256 (KDE/Qt/6.7.0/qt3d-everywhere-src-6.7.0.tar.xz) = 803b82a8be8632b79f4fc717b236edba716100ab274a54349add439056896424 -SIZE (KDE/Qt/6.7.0/qt3d-everywhere-src-6.7.0.tar.xz) = 141570596 +TIMESTAMP = 1716399415 +SHA256 (KDE/Qt/6.7.1/qt3d-everywhere-src-6.7.1.tar.xz) = f59ec0ac81bd6a1b88359bae7362017dc1ca3371726f5c5399a34d2f80d5357b +SIZE (KDE/Qt/6.7.1/qt3d-everywhere-src-6.7.1.tar.xz) = 141586868 diff --git a/graphics/qt6-imageformats/Makefile b/graphics/qt6-imageformats/Makefile index 9980caaac76d..089524f14b3f 100644 --- a/graphics/qt6-imageformats/Makefile +++ b/graphics/qt6-imageformats/Makefile @@ -1,6 +1,5 @@ PORTNAME= imageformats DISTVERSION= ${QT6_VERSION} -PORTREVISION= 1 CATEGORIES= graphics PKGNAMEPREFIX= qt6- diff --git a/graphics/qt6-imageformats/distinfo b/graphics/qt6-imageformats/distinfo index 0d69cf675afd..4aadd2b69198 100644 --- a/graphics/qt6-imageformats/distinfo +++ b/graphics/qt6-imageformats/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712113041 -SHA256 (KDE/Qt/6.7.0/qtimageformats-everywhere-src-6.7.0.tar.xz) = 516ce07ec8dd5a11c59816fe33ddb71d4f691d0ebbc1798ac338f23b86c029a7 -SIZE (KDE/Qt/6.7.0/qtimageformats-everywhere-src-6.7.0.tar.xz) = 1968344 +TIMESTAMP = 1716399418 +SHA256 (KDE/Qt/6.7.1/qtimageformats-everywhere-src-6.7.1.tar.xz) = a733b98f771064d000476b8861f822143982749448ba8abf9f1813edb8dfe79f +SIZE (KDE/Qt/6.7.1/qtimageformats-everywhere-src-6.7.1.tar.xz) = 1971500 diff --git a/graphics/qt6-lottie/distinfo b/graphics/qt6-lottie/distinfo index b459793011d5..a6930456ff80 100644 --- a/graphics/qt6-lottie/distinfo +++ b/graphics/qt6-lottie/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712113044 -SHA256 (KDE/Qt/6.7.0/qtlottie-everywhere-src-6.7.0.tar.xz) = 9c0ffbde3c99e006bd13c844a1d691e275c02db1c3db44d05154c939d23ba2ed -SIZE (KDE/Qt/6.7.0/qtlottie-everywhere-src-6.7.0.tar.xz) = 83008 +TIMESTAMP = 1716399420 +SHA256 (KDE/Qt/6.7.1/qtlottie-everywhere-src-6.7.1.tar.xz) = 6ade1069cbd3e68462b3d0be152e781021845f2496d3d528dbf8065e0994a27c +SIZE (KDE/Qt/6.7.1/qtlottie-everywhere-src-6.7.1.tar.xz) = 83660 diff --git a/graphics/qt6-quickeffectmaker/distinfo b/graphics/qt6-quickeffectmaker/distinfo index 8394bf0acb0d..a4f0fa28e9b1 100644 --- a/graphics/qt6-quickeffectmaker/distinfo +++ b/graphics/qt6-quickeffectmaker/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712113053 -SHA256 (KDE/Qt/6.7.0/qtquickeffectmaker-everywhere-src-6.7.0.tar.xz) = 3d0fec664061ca35cc69162c8eb9ae3bc49628eb417ca9def5fb8946b8bc04d5 -SIZE (KDE/Qt/6.7.0/qtquickeffectmaker-everywhere-src-6.7.0.tar.xz) = 4358300 +TIMESTAMP = 1716399426 +SHA256 (KDE/Qt/6.7.1/qtquickeffectmaker-everywhere-src-6.7.1.tar.xz) = 4b0212ac79f826455c71792c14e90d3420bdbd0bea4981dc2b3e5d8d316c36e2 +SIZE (KDE/Qt/6.7.1/qtquickeffectmaker-everywhere-src-6.7.1.tar.xz) = 4358308 diff --git a/graphics/qt6-svg/distinfo b/graphics/qt6-svg/distinfo index b5f58f467651..02db02ddd80e 100644 --- a/graphics/qt6-svg/distinfo +++ b/graphics/qt6-svg/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712113058 -SHA256 (KDE/Qt/6.7.0/qtsvg-everywhere-src-6.7.0.tar.xz) = 1518f40e08ff5e6153a6e26e5b95b033413ac143b70795dc1317e7f73ebf922d -SIZE (KDE/Qt/6.7.0/qtsvg-everywhere-src-6.7.0.tar.xz) = 1790244 +TIMESTAMP = 1716399430 +SHA256 (KDE/Qt/6.7.1/qtsvg-everywhere-src-6.7.1.tar.xz) = 3ed5b80f7228c41dd463b7a57284ed273d224d1c323c0dd78c5209635807cbce +SIZE (KDE/Qt/6.7.1/qtsvg-everywhere-src-6.7.1.tar.xz) = 1790712 diff --git a/graphics/qt6-wayland/distinfo b/graphics/qt6-wayland/distinfo index 2d5d8f905c6b..964e3e8e9125 100644 --- a/graphics/qt6-wayland/distinfo +++ b/graphics/qt6-wayland/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712113061 -SHA256 (KDE/Qt/6.7.0/qtwayland-everywhere-src-6.7.0.tar.xz) = d73470e4217da388d8cd2a517ee8bb373853f33c569306e80f04397845157aea -SIZE (KDE/Qt/6.7.0/qtwayland-everywhere-src-6.7.0.tar.xz) = 1121748 +TIMESTAMP = 1716399433 +SHA256 (KDE/Qt/6.7.1/qtwayland-everywhere-src-6.7.1.tar.xz) = 7ef176a8e701c90edd8e591dad36f83c30d623ef94439ff62cafcffd46a83d20 +SIZE (KDE/Qt/6.7.1/qtwayland-everywhere-src-6.7.1.tar.xz) = 1122036 diff --git a/misc/qt6-doc/distinfo b/misc/qt6-doc/distinfo index 6afacbe9135b..07679c987a48 100644 --- a/misc/qt6-doc/distinfo +++ b/misc/qt6-doc/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712113085 -SHA256 (KDE/Qt/6.7.0/qtdoc-everywhere-src-6.7.0.tar.xz) = 991e5e10c04de4b5cc14577adaad69375dd092ee95a1577c0ce377c4b2019c40 -SIZE (KDE/Qt/6.7.0/qtdoc-everywhere-src-6.7.0.tar.xz) = 13974180 +TIMESTAMP = 1716399452 +SHA256 (KDE/Qt/6.7.1/qtdoc-everywhere-src-6.7.1.tar.xz) = cd682e0844ac2ed3e2ff78900b2cc5cc19a2da02969eb83e387339644113534d +SIZE (KDE/Qt/6.7.1/qtdoc-everywhere-src-6.7.1.tar.xz) = 14496284 diff --git a/misc/qt6-doc/pkg-plist b/misc/qt6-doc/pkg-plist index 373bde1aa6d6..b7bf610b4068 100644 --- a/misc/qt6-doc/pkg-plist +++ b/misc/qt6-doc/pkg-plist @@ -93,21 +93,27 @@ %%QT_DOCDIR%%/qtdoc/i18n-plural-rules.html %%QT_DOCDIR%%/qtdoc/i18n-source-translation.html %%QT_DOCDIR%%/qtdoc/images/5OiIqFTjUZI.jpg +%%QT_DOCDIR%%/qtdoc/images/Android_Studio_Settings.png %%QT_DOCDIR%%/qtdoc/images/BenchmarkDemoQt6.png +%%QT_DOCDIR%%/qtdoc/images/CheckPluginInstall.png %%QT_DOCDIR%%/qtdoc/images/CustomStyle_Dark.png %%QT_DOCDIR%%/qtdoc/images/CustomStyle_Light.png %%QT_DOCDIR%%/qtdoc/images/FX_Material_Showroom.png %%QT_DOCDIR%%/qtdoc/images/Material_Dark.png %%QT_DOCDIR%%/qtdoc/images/Material_Light.png +%%QT_DOCDIR%%/qtdoc/images/SettingsSet.png %%QT_DOCDIR%%/qtdoc/images/Settings_CustomStyle.png %%QT_DOCDIR%%/qtdoc/images/Settings_Material.png +%%QT_DOCDIR%%/qtdoc/images/Settings_Qt.png %%QT_DOCDIR%%/qtdoc/images/Settings_iOS.png +%%QT_DOCDIR%%/qtdoc/images/_AkKSLp5FnM.png %%QT_DOCDIR%%/qtdoc/images/accessibleobjecttree.png %%QT_DOCDIR%%/qtdoc/images/addalarms.png %%QT_DOCDIR%%/qtdoc/images/alarms2.png %%QT_DOCDIR%%/qtdoc/images/alarms3.png %%QT_DOCDIR%%/qtdoc/images/android-single-abis.png %%QT_DOCDIR%%/qtdoc/images/android-source-folder.png +%%QT_DOCDIR%%/qtdoc/images/android_studio_select_run.png %%QT_DOCDIR%%/qtdoc/images/animation-examples.png %%QT_DOCDIR%%/qtdoc/images/applicationwindow.png %%QT_DOCDIR%%/qtdoc/images/arrow_bc.png @@ -125,6 +131,8 @@ %%QT_DOCDIR%%/qtdoc/images/colorpalette_urlselection.png %%QT_DOCDIR%%/qtdoc/images/colorpalette_userlisting.png %%QT_DOCDIR%%/qtdoc/images/controls.png +%%QT_DOCDIR%%/qtdoc/images/create_new_Qt_project_1.png +%%QT_DOCDIR%%/qtdoc/images/create_new_Qt_project_2.png %%QT_DOCDIR%%/qtdoc/images/deployment-mac-application.png %%QT_DOCDIR%%/qtdoc/images/deployment-mac-bundlestructure.png %%QT_DOCDIR%%/qtdoc/images/desktop_dark.png @@ -159,6 +167,7 @@ %%QT_DOCDIR%%/qtdoc/images/nmvurCcsWos.jpg %%QT_DOCDIR%%/qtdoc/images/ok.png %%QT_DOCDIR%%/qtdoc/images/open-project.png +%%QT_DOCDIR%%/qtdoc/images/open_existing_project.png %%QT_DOCDIR%%/qtdoc/images/osmbuildings.jpg %%QT_DOCDIR%%/qtdoc/images/piemenu.gif %%QT_DOCDIR%%/qtdoc/images/project-structure.png @@ -219,6 +228,9 @@ %%QT_DOCDIR%%/qtdoc/images/sa8155-target.png %%QT_DOCDIR%%/qtdoc/images/sa8155p.png %%QT_DOCDIR%%/qtdoc/images/scalability-gridlayout.png +%%QT_DOCDIR%%/qtdoc/images/select_example_project.png +%%QT_DOCDIR%%/qtdoc/images/select_gear_install_plugin.png +%%QT_DOCDIR%%/qtdoc/images/selectpluginjar.png %%QT_DOCDIR%%/qtdoc/images/session.png %%QT_DOCDIR%%/qtdoc/images/small_dark.png %%QT_DOCDIR%%/qtdoc/images/small_light.png @@ -320,6 +332,8 @@ %%QT_DOCDIR%%/qtdoc/qt-gui-concepts.html %%QT_DOCDIR%%/qtdoc/qt-intro.html %%QT_DOCDIR%%/qtdoc/qt-online-installation.html +%%QT_DOCDIR%%/qtdoc/qt-releases.html +%%QT_DOCDIR%%/qtdoc/qt-tools-for-android-studio.html %%QT_DOCDIR%%/qtdoc/qt6-buildsystem.html %%QT_DOCDIR%%/qtdoc/qtconcurrent-mtexamples.html %%QT_DOCDIR%%/qtdoc/qtconcurrentexamples.html diff --git a/misc/qt6-examples/distinfo b/misc/qt6-examples/distinfo index 22a0b03984a9..2cbcb938aa5e 100644 --- a/misc/qt6-examples/distinfo +++ b/misc/qt6-examples/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712114556 -SHA256 (KDE/Qt/6.7.0/qt-everywhere-src-6.7.0.tar.xz) = bf5089912364f99cf9baf6c109de76a3172eec6267f148c69800575c47f90087 -SIZE (KDE/Qt/6.7.0/qt-everywhere-src-6.7.0.tar.xz) = 934507900 +TIMESTAMP = 1716400386 +SHA256 (KDE/Qt/6.7.1/qt-everywhere-src-6.7.1.tar.xz) = 38dbf2768776e875ed5cdea8cccf1a240512a29769768084430914c4a33bedc4 +SIZE (KDE/Qt/6.7.1/qt-everywhere-src-6.7.1.tar.xz) = 935584748 diff --git a/misc/qt6-examples/pkg-plist b/misc/qt6-examples/pkg-plist index 0921e2a98d94..132ccb6af4cf 100644 --- a/misc/qt6-examples/pkg-plist +++ b/misc/qt6-examples/pkg-plist @@ -1002,6 +1002,7 @@ %%QT_EXAMPLEDIR%%/demos/calqlatr/ios/Assets.xcassets/AppIcon.appiconset/AppleIconCalqlatr.png %%QT_EXAMPLEDIR%%/demos/calqlatr/ios/Assets.xcassets/AppIcon.appiconset/Contents.json %%QT_EXAMPLEDIR%%/demos/calqlatr/main.cpp +%%QT_EXAMPLEDIR%%/demos/calqlatr/qmldir %%QT_EXAMPLEDIR%%/demos/car-configurator/CMakeLists.txt %%QT_EXAMPLEDIR%%/demos/car-configurator/CarRendering.qmlproject %%QT_EXAMPLEDIR%%/demos/car-configurator/CarRendering.qmlproject.qtds @@ -1705,6 +1706,7 @@ %%QT_EXAMPLEDIR%%/demos/mediaplayer/doc/images/theme_info.png %%QT_EXAMPLEDIR%%/demos/mediaplayer/doc/src/mediaplayer.qdoc %%QT_EXAMPLEDIR%%/demos/mediaplayer/doc/src/mediaplayer.rst +%%QT_EXAMPLEDIR%%/demos/mediaplayer/filenameprovider.h %%QT_EXAMPLEDIR%%/demos/mediaplayer/main.cpp %%QT_EXAMPLEDIR%%/demos/mediaplayer/mediaplayer.py %%QT_EXAMPLEDIR%%/demos/mediaplayer/mediaplayer.pyproject @@ -3051,7 +3053,6 @@ %%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/qmlvideo.png %%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/qmlvideo.pro %%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/qmlvideo.svg -%%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/qmlvideo/Button.qml %%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/qmlvideo/CMakeLists.txt %%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/qmlvideo/CameraBasic.qml %%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/qmlvideo/CameraDrag.qml @@ -3099,6 +3100,9 @@ %%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/qmlvideo/images/leaves.jpg %%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/qmlvideo/images/up.png %%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/qmlvideo/qmldir +%%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/qmlvideo/qmlvideo_global.h +%%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/qmlvideo/videosingleton.cpp +%%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/qmlvideo/videosingleton.h %%QT_EXAMPLEDIR%%/multimedia/video/qmlvideo/trace.h %%QT_EXAMPLEDIR%%/multimedia/video/recorder/AudioInputSelect.qml %%QT_EXAMPLEDIR%%/multimedia/video/recorder/CMakeLists.txt @@ -3651,6 +3655,48 @@ %%QT_EXAMPLEDIR%%/pdfwidgets/pdfviewer/zoomselector.cpp %%QT_EXAMPLEDIR%%/pdfwidgets/pdfviewer/zoomselector.h %%QT_EXAMPLEDIR%%/pdfwidgets/pdfwidgets.pro +%%QT_EXAMPLEDIR%%/platforms/CMakeLists.txt +%%QT_EXAMPLEDIR%%/platforms/android/CMakeLists.txt +%%QT_EXAMPLEDIR%%/platforms/android/doc/images/portrait_java.png +%%QT_EXAMPLEDIR%%/platforms/android/doc/src/qml_in_java_based_android_project.qdoc +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_android_view/CMakeLists.txt +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_android_view/main.cpp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_android_view/main.qml +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/CMakeLists.txt +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/build.gradle +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/AndroidManifest.xml +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/java/com/example/qml_in_java_based_android_project/Colors.java +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/java/com/example/qml_in_java_based_android_project/MainActivity.java +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/drawable/ic_launcher_background.xml +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/drawable/ic_launcher_foreground.xml +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/layout/activity_main.xml +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-anydpi-v26/ic_launcher.xml +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-anydpi-v26/ic_launcher_round.xml +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-hdpi/ic_launcher.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-hdpi/ic_launcher_foreground.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-hdpi/ic_launcher_round.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-mdpi/ic_launcher.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-mdpi/ic_launcher_foreground.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-mdpi/ic_launcher_round.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-xhdpi/ic_launcher.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-xhdpi/ic_launcher_foreground.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-xhdpi/ic_launcher_round.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-xxhdpi/ic_launcher.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-xxhdpi/ic_launcher_foreground.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-xxhdpi/ic_launcher_round.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-xxxhdpi/ic_launcher.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-xxxhdpi/ic_launcher_foreground.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/mipmap-xxxhdpi/ic_launcher_round.webp +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/values/colors.xml +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/values/strings.xml +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/values/styles.xml +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/values/themes.xml +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/xml/backup_rules.xml +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/app/src/main/res/xml/data_extraction_rules.xml +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/build.gradle +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/gradle.properties +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/gradle/wrapper/gradle-wrapper.properties +%%QT_EXAMPLEDIR%%/platforms/android/qml_in_java_based_android_project/settings.gradle %%QT_EXAMPLEDIR%%/positioning/CMakeLists.txt %%QT_EXAMPLEDIR%%/positioning/logfilepositionsource/CMakeLists.txt %%QT_EXAMPLEDIR%%/positioning/logfilepositionsource/clientapplication.cpp @@ -3863,29 +3909,32 @@ %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml-advanced/advanced7-Foreign-objects-integration/qmldir.in %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml-advanced/extending-qml-advanced.pro %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/CMakeLists.txt +%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter1-basics/App.qml %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter1-basics/CMakeLists.txt -%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter1-basics/app.qml %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter1-basics/chapter1-basics.pro %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter1-basics/chapter1-basics.qrc %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter1-basics/main.cpp %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter1-basics/piechart.cpp %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter1-basics/piechart.h +%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter1-basics/qmldir +%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter2-methods/App.qml %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter2-methods/CMakeLists.txt -%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter2-methods/app.qml %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter2-methods/chapter2-methods.pro %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter2-methods/chapter2-methods.qrc %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter2-methods/main.cpp %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter2-methods/piechart.cpp %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter2-methods/piechart.h +%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter2-methods/qmldir +%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter3-bindings/App.qml %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter3-bindings/CMakeLists.txt -%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter3-bindings/app.qml %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter3-bindings/chapter3-bindings.pro %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter3-bindings/chapter3-bindings.qrc %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter3-bindings/main.cpp %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter3-bindings/piechart.cpp %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter3-bindings/piechart.h +%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter3-bindings/qmldir +%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter4-customPropertyTypes/App.qml %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter4-customPropertyTypes/CMakeLists.txt -%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter4-customPropertyTypes/app.qml %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter4-customPropertyTypes/chapter4-customPropertyTypes.pro %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter4-customPropertyTypes/chapter4-customPropertyTypes.qrc %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter4-customPropertyTypes/main.cpp @@ -3893,8 +3942,9 @@ %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter4-customPropertyTypes/piechart.h %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter4-customPropertyTypes/pieslice.cpp %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter4-customPropertyTypes/pieslice.h +%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter4-customPropertyTypes/qmldir +%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter5-listproperties/App.qml %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter5-listproperties/CMakeLists.txt -%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter5-listproperties/app.qml %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter5-listproperties/chapter5-listproperties.pro %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter5-listproperties/chapter5-listproperties.qrc %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter5-listproperties/main.cpp @@ -3902,6 +3952,8 @@ %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter5-listproperties/piechart.h %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter5-listproperties/pieslice.cpp %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter5-listproperties/pieslice.h +%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter5-listproperties/qmldir +%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter6-plugins/App.qml %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter6-plugins/CMakeLists.txt %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter6-plugins/Charts/CMakeLists.txt %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter6-plugins/Charts/Charts.pro @@ -3912,10 +3964,10 @@ %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter6-plugins/Charts/pieslice.h %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter6-plugins/Charts/qmldir %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter6-plugins/app.pro -%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter6-plugins/app.qml %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter6-plugins/app.qrc %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter6-plugins/chapter6-plugins.pro %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter6-plugins/main.cpp +%%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/chapter6-plugins/qmldir %%QT_EXAMPLEDIR%%/qml/tutorials/extending-qml/extending-qml.pro %%QT_EXAMPLEDIR%%/qml/tutorials/tutorials.pro %%QT_EXAMPLEDIR%%/qmlcompiler/tutorials/helloworld/chapter1/CMakeLists.txt @@ -4972,7 +5024,6 @@ %%QT_EXAMPLEDIR%%/quick/shared/Images.qml %%QT_EXAMPLEDIR%%/quick/shared/Label.qml %%QT_EXAMPLEDIR%%/quick/shared/LauncherList.qml -%%QT_EXAMPLEDIR%%/quick/shared/QtBundleQmlModuleForMacOS.cmake %%QT_EXAMPLEDIR%%/quick/shared/README %%QT_EXAMPLEDIR%%/quick/shared/SimpleLauncherDelegate.qml %%QT_EXAMPLEDIR%%/quick/shared/Slider.qml @@ -7608,6 +7659,7 @@ %%QT_EXAMPLEDIR%%/websockets/sslechoclient/sslechoclient.h %%QT_EXAMPLEDIR%%/websockets/sslechoclient/sslechoclient.pro %%QT_EXAMPLEDIR%%/websockets/sslechoserver/CMakeLists.txt +%%QT_EXAMPLEDIR%%/websockets/sslechoserver/generate.sh %%QT_EXAMPLEDIR%%/websockets/sslechoserver/localhost.cert %%QT_EXAMPLEDIR%%/websockets/sslechoserver/localhost.key %%QT_EXAMPLEDIR%%/websockets/sslechoserver/main.cpp @@ -7754,7 +7806,6 @@ %%QT_EXAMPLEDIR%%/widgets/doc/src/calendarwidget.qdoc %%QT_EXAMPLEDIR%%/widgets/doc/src/chip.qdoc %%QT_EXAMPLEDIR%%/widgets/doc/src/collidingmice-example.qdoc -%%QT_EXAMPLEDIR%%/widgets/doc/src/coloreditorfactory.qdoc %%QT_EXAMPLEDIR%%/widgets/doc/src/combowidgetmapper.qdoc %%QT_EXAMPLEDIR%%/widgets/doc/src/completer.qdoc %%QT_EXAMPLEDIR%%/widgets/doc/src/composition.qdoc @@ -7774,7 +7825,6 @@ %%QT_EXAMPLEDIR%%/widgets/doc/src/gallery.qdoc %%QT_EXAMPLEDIR%%/widgets/doc/src/gradients.qdoc %%QT_EXAMPLEDIR%%/widgets/doc/src/graphicsview-simpleanchorlayout.qdoc -%%QT_EXAMPLEDIR%%/widgets/doc/src/groupbox.qdoc %%QT_EXAMPLEDIR%%/widgets/doc/src/imagecomposition.qdoc %%QT_EXAMPLEDIR%%/widgets/doc/src/licensewizard.qdoc %%QT_EXAMPLEDIR%%/widgets/doc/src/lineedits.qdoc @@ -7948,13 +7998,6 @@ %%QT_EXAMPLEDIR%%/widgets/itemviews/basicsortfiltermodel/main.cpp %%QT_EXAMPLEDIR%%/widgets/itemviews/basicsortfiltermodel/window.cpp %%QT_EXAMPLEDIR%%/widgets/itemviews/basicsortfiltermodel/window.h -%%QT_EXAMPLEDIR%%/widgets/itemviews/coloreditorfactory/CMakeLists.txt -%%QT_EXAMPLEDIR%%/widgets/itemviews/coloreditorfactory/coloreditorfactory.pro -%%QT_EXAMPLEDIR%%/widgets/itemviews/coloreditorfactory/colorlisteditor.cpp -%%QT_EXAMPLEDIR%%/widgets/itemviews/coloreditorfactory/colorlisteditor.h -%%QT_EXAMPLEDIR%%/widgets/itemviews/coloreditorfactory/main.cpp -%%QT_EXAMPLEDIR%%/widgets/itemviews/coloreditorfactory/window.cpp -%%QT_EXAMPLEDIR%%/widgets/itemviews/coloreditorfactory/window.h %%QT_EXAMPLEDIR%%/widgets/itemviews/combowidgetmapper/CMakeLists.txt %%QT_EXAMPLEDIR%%/widgets/itemviews/combowidgetmapper/combowidgetmapper.pro %%QT_EXAMPLEDIR%%/widgets/itemviews/combowidgetmapper/main.cpp @@ -8389,11 +8432,6 @@ %%QT_EXAMPLEDIR%%/widgets/widgets/calendarwidget/main.cpp %%QT_EXAMPLEDIR%%/widgets/widgets/calendarwidget/window.cpp %%QT_EXAMPLEDIR%%/widgets/widgets/calendarwidget/window.h -%%QT_EXAMPLEDIR%%/widgets/widgets/groupbox/CMakeLists.txt -%%QT_EXAMPLEDIR%%/widgets/widgets/groupbox/groupbox.pro -%%QT_EXAMPLEDIR%%/widgets/widgets/groupbox/main.cpp -%%QT_EXAMPLEDIR%%/widgets/widgets/groupbox/window.cpp -%%QT_EXAMPLEDIR%%/widgets/widgets/groupbox/window.h %%QT_EXAMPLEDIR%%/widgets/widgets/lineedits/CMakeLists.txt %%QT_EXAMPLEDIR%%/widgets/widgets/lineedits/lineedits.pro %%QT_EXAMPLEDIR%%/widgets/widgets/lineedits/main.cpp diff --git a/multimedia/qt6-multimedia/Makefile b/multimedia/qt6-multimedia/Makefile index 88c6f844cb8e..8556d26cfdd2 100644 --- a/multimedia/qt6-multimedia/Makefile +++ b/multimedia/qt6-multimedia/Makefile @@ -3,9 +3,6 @@ DISTVERSION= ${QT6_VERSION} CATEGORIES= multimedia PKGNAMEPREFIX= qt6- -PATCH_SITES= https://github.com/qt/qtmultimedia/commit/ -PATCHFILES+= 7fcea568c9c64f3bcebda21f0df02aa0107dfd0c.patch:-p1 - MAINTAINER= kde@FreeBSD.org COMMENT= Qt audio, video, radio and camera support module @@ -14,18 +11,17 @@ LIB_DEPENDS= libxkbcommon.so:x11/libxkbcommon USES= cmake compiler:c++17-lang gl localbase:ldflags pkgconfig qt-dist:6 USE_GL= opengl -USE_QT= base declarative +USE_QT= base declarative shadertools:build +CFLAGS_powerpc= -DPFFFT_SIMD_DISABLE CXXFLAGS_powerpc64= -mvsx -CFLAGS_powerpc= -DPFFFT_SIMD_DISABLE -OPTIONS_DEFINE= FFMPEG GSTREAMER Q3D V4L VAAPI X11 -OPTIONS_DEFAULT=FFMPEG GSTREAMER PULSEAUDIO Q3D V4L VAAPI X11 -OPTIONS_SINGLE= AUDIO +OPTIONS_DEFINE= FFMPEG GSTREAMER Q3D V4L VAAPI X11 +OPTIONS_DEFAULT= FFMPEG GSTREAMER PULSEAUDIO Q3D V4L VAAPI X11 +AUDIO_DESC= Low-level audio backend +OPTIONS_SINGLE= AUDIO OPTIONS_SINGLE_AUDIO= ALSA PULSEAUDIO -OPTIONS_SUB= yes - -AUDIO_DESC= Low level Audio Backend +OPTIONS_SUB= yes ALSA_LIB_DEPENDS= libasound.so:audio/alsa-lib ALSA_CMAKE_BOOL= FEATURE_alsa @@ -35,12 +31,16 @@ FFMPEG_CMAKE_BOOL= FEATURE_ffmpeg GSTREAMER_USES= gnome gstreamer:1 GSTREAMER_USE= GL=egl GNOME=glib20 GSTREAMER=bad,gl,good,ugly -GSTREAMER_CMAKE_BOOL= FEATURE_gstreamer +GSTREAMER_CMAKE_BOOL= FEATURE_gstreamer \ + FEATURE_gstreamer_1_0 \ + FEATURE_gstreamer_app \ + FEATURE_gstreamer_gl \ + FEATURE_gstreamer_photography PULSEAUDIO_LIB_DEPENDS= libpulse.so:audio/pulseaudio PULSEAUDIO_CMAKE_BOOL= FEATURE_pulseaudio -Q3D_DESC= Spatial Audio via Quick3D +Q3D_DESC= Spatial audio support via QtQuick3D Q3D_USE= QT=quick3d,shadertools Q3D_CMAKE_BOOL= FEATURE_spatialaudio_quick3d @@ -53,16 +53,11 @@ VAAPI_USE= GL=egl VAAPI_CMAKE_BOOL= FEATURE_vaapi VAAPI_IMPLIES= FFMPEG +# We assume that the Qt stack has been built with consistent X11 options. +# QT_FEATURE_xlib is defined globally by devel/qt6-base based upon whether +# the X11 option was enabled in that port. X11_USES= xorg X11_USE= XORG=x11,xext,xrandr -X11_CMAKE_BOOL= FEATURE_xlib X11_IMPLIES= FFMPEG -.include - -post-install: -.if !(${PORT_OPTIONS:MFFMPEG} || ${PORT_OPTIONS:MGSTREAMER}) - @${REINPLACE_CMD} '/MultimediaPlugins\.cmake/d' ${TMPPLIST} -.endif - .include diff --git a/multimedia/qt6-multimedia/distinfo b/multimedia/qt6-multimedia/distinfo index 58d29a34a088..6a7afe75e6c0 100644 --- a/multimedia/qt6-multimedia/distinfo +++ b/multimedia/qt6-multimedia/distinfo @@ -1,5 +1,3 @@ -TIMESTAMP = 1712784204 -SHA256 (KDE/Qt/6.7.0/qtmultimedia-everywhere-src-6.7.0.tar.xz) = f394bae49e3d4ee6a3b0c9e1e5e31bb870cc04a4b44f4cda3615baf7bd078c70 -SIZE (KDE/Qt/6.7.0/qtmultimedia-everywhere-src-6.7.0.tar.xz) = 8315312 -SHA256 (KDE/Qt/6.7.0/7fcea568c9c64f3bcebda21f0df02aa0107dfd0c.patch) = ccaf3db6425e43ae19354ae797dbff66176e63a7c31238bbeb90dd10cf940e03 -SIZE (KDE/Qt/6.7.0/7fcea568c9c64f3bcebda21f0df02aa0107dfd0c.patch) = 8797 +TIMESTAMP = 1716422731 +SHA256 (KDE/Qt/6.7.1/qtmultimedia-everywhere-src-6.7.1.tar.xz) = 656d1543727f5bf1bd39fe2548ac454860109dc8555df77d7940f21e3d65cd3e +SIZE (KDE/Qt/6.7.1/qtmultimedia-everywhere-src-6.7.1.tar.xz) = 8362120 diff --git a/multimedia/qt6-multimedia/files/patch-src_multimedia_configure.cmake b/multimedia/qt6-multimedia/files/patch-src_multimedia_configure.cmake index 6dc30b473b06..db0a3240d0c0 100644 --- a/multimedia/qt6-multimedia/files/patch-src_multimedia_configure.cmake +++ b/multimedia/qt6-multimedia/files/patch-src_multimedia_configure.cmake @@ -1,4 +1,4 @@ ---- src/multimedia/configure.cmake.orig 2024-03-19 05:09:26 UTC +--- src/multimedia/configure.cmake.orig 2024-05-09 03:10:16 UTC +++ src/multimedia/configure.cmake @@ -76,7 +76,7 @@ qt_feature("ffmpeg" PRIVATE LABEL "FFmpeg" @@ -9,12 +9,3 @@ ) qt_feature("alsa" PUBLIC PRIVATE LABEL "ALSA (experimental)" -@@ -101,7 +101,7 @@ qt_feature("gstreamer_1_0" PRIVATE - ) - qt_feature("gstreamer_1_0" PRIVATE - LABEL "GStreamer 1.0" -- CONDITION ( LINUX AND GStreamer_FOUND ) -+ CONDITION GStreamer_FOUND - ENABLE INPUT_gstreamer STREQUAL 'yes' - DISABLE INPUT_gstreamer STREQUAL 'no' - ) diff --git a/multimedia/qt6-multimedia/pkg-help b/multimedia/qt6-multimedia/pkg-help new file mode 100644 index 000000000000..c6f087279d66 --- /dev/null +++ b/multimedia/qt6-multimedia/pkg-help @@ -0,0 +1,2 @@ +The X11 option should only be enabled if the FFMPEG option is also +enabled and devel/qt6-base has been built with the X11 option enabled. diff --git a/multimedia/qt6-multimedia/pkg-plist b/multimedia/qt6-multimedia/pkg-plist index 01459b6f8ff3..85879cfe04d2 100644 --- a/multimedia/qt6-multimedia/pkg-plist +++ b/multimedia/qt6-multimedia/pkg-plist @@ -3,6 +3,7 @@ %%ALSA%%%%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qalsaaudiosink_p.h %%ALSA%%%%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qalsaaudiosource_p.h %%ALSA%%%%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qalsamediadevices_p.h +%%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qaudiodecoder_p.h %%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qaudiodevice_p.h %%PULSEAUDIO%%%%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qaudioengine_pulse_p.h %%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qaudiohelpers_p.h @@ -14,6 +15,7 @@ %%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qcapturablewindow_p.h %%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qerrorinfo_p.h %%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qimagevideobuffer_p.h +%%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qmaybe_p.h %%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qmediaplayer_p.h %%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qmediarecorder_p.h %%QT_INCDIR%%/QtMultimedia/%%FULLVER%%/QtMultimedia/private/qmediastoragelocation_p.h @@ -144,6 +146,40 @@ %%QT_INCDIR%%/QtMultimediaWidgets/qtmultimediawidgetsglobal.h %%QT_INCDIR%%/QtMultimediaWidgets/qtmultimediawidgetsversion.h %%QT_INCDIR%%/QtMultimediaWidgets/qvideowidget.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qglist_helper_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgst_debug_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgst_handle_types_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgst_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstappsource_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstpipeline_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreameraudiodecoder_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreameraudiodevice_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreameraudioinput_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreameraudiooutput_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreameraudiosink_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreameraudiosource_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamerbufferprobe_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamercamera_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamerformatinfo_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamerimagecapture_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamerintegration_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamermediacapture_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamermediaencoder_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamermediaplayer_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamermessage_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamermetadata_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamervideodevices_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamervideooutput_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamervideooverlay_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstreamervideosink_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstsubtitlesink_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstutils_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstvideobuffer_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/%%FULLVER%%/QtQGstreamerMediaPlugin/private/qgstvideorenderersink_p.h +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/QtQGstreamerMediaPlugin +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/QtQGstreamerMediaPluginDepends +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/QtQGstreamerMediaPluginVersion +%%GSTREAMER%%%%QT_INCDIR%%/QtQGstreamerMediaPlugin/qtqgstreamermediapluginversion.h %%Q3D%%%%QT_INCDIR%%/QtQuick3DSpatialAudio/%%FULLVER%%/QtQuick3DSpatialAudio/private/qquick3dambientsound_p.h %%Q3D%%%%QT_INCDIR%%/QtQuick3DSpatialAudio/%%FULLVER%%/QtQuick3DSpatialAudio/private/qquick3daudioengine_p.h %%Q3D%%%%QT_INCDIR%%/QtQuick3DSpatialAudio/%%FULLVER%%/QtQuick3DSpatialAudio/private/qquick3daudiolistener_p.h @@ -232,6 +268,14 @@ lib/cmake/Qt6MultimediaWidgets/Qt6MultimediaWidgetsDependencies.cmake lib/cmake/Qt6MultimediaWidgets/Qt6MultimediaWidgetsTargets-%%CMAKE_BUILD_TYPE%%.cmake lib/cmake/Qt6MultimediaWidgets/Qt6MultimediaWidgetsTargets.cmake lib/cmake/Qt6MultimediaWidgets/Qt6MultimediaWidgetsVersionlessTargets.cmake +%%GSTREAMER%%lib/cmake/Qt6QGstreamerMediaPluginPrivate/Qt6QGstreamerMediaPluginPrivateAdditionalTargetInfo.cmake +%%GSTREAMER%%lib/cmake/Qt6QGstreamerMediaPluginPrivate/Qt6QGstreamerMediaPluginPrivateConfig.cmake +%%GSTREAMER%%lib/cmake/Qt6QGstreamerMediaPluginPrivate/Qt6QGstreamerMediaPluginPrivateConfigVersion.cmake +%%GSTREAMER%%lib/cmake/Qt6QGstreamerMediaPluginPrivate/Qt6QGstreamerMediaPluginPrivateConfigVersionImpl.cmake +%%GSTREAMER%%lib/cmake/Qt6QGstreamerMediaPluginPrivate/Qt6QGstreamerMediaPluginPrivateDependencies.cmake +%%GSTREAMER%%lib/cmake/Qt6QGstreamerMediaPluginPrivate/Qt6QGstreamerMediaPluginPrivateTargets-%%CMAKE_BUILD_TYPE%%.cmake +%%GSTREAMER%%lib/cmake/Qt6QGstreamerMediaPluginPrivate/Qt6QGstreamerMediaPluginPrivateTargets.cmake +%%GSTREAMER%%lib/cmake/Qt6QGstreamerMediaPluginPrivate/Qt6QGstreamerMediaPluginPrivateVersionlessTargets.cmake %%Q3D%%lib/cmake/Qt6Qml/QmlPlugins/Qt6quick3dspatialaudioAdditionalTargetInfo.cmake %%Q3D%%lib/cmake/Qt6Qml/QmlPlugins/Qt6quick3dspatialaudioConfig.cmake %%Q3D%%lib/cmake/Qt6Qml/QmlPlugins/Qt6quick3dspatialaudioConfigVersion.cmake @@ -273,6 +317,8 @@ lib/cmake/Qt6SpatialAudio/Qt6SpatialAudioVersionlessTargets.cmake %%QT_LIBDIR%%/libQt6MultimediaWidgets.so %%QT_LIBDIR%%/libQt6MultimediaWidgets.so.6 %%QT_LIBDIR%%/libQt6MultimediaWidgets.so.%%FULLVER%% +%%GSTREAMER%%%%QT_LIBDIR%%/libQt6QGstreamerMediaPlugin.a +%%GSTREAMER%%%%QT_LIBDIR%%/libQt6QGstreamerMediaPlugin.prl %%Q3D%%%%QT_LIBDIR%%/libQt6Quick3DSpatialAudio.prl %%Q3D%%%%QT_LIBDIR%%/libQt6Quick3DSpatialAudio.so %%Q3D%%%%QT_LIBDIR%%/libQt6Quick3DSpatialAudio.so.6 @@ -284,6 +330,7 @@ lib/cmake/Qt6SpatialAudio/Qt6SpatialAudioVersionlessTargets.cmake %%QT_LIBDIR%%/metatypes/qt6multimedia_%%CMAKE_BUILD_TYPE%%_metatypes.json %%QT_LIBDIR%%/metatypes/qt6multimediaquickprivate_%%CMAKE_BUILD_TYPE%%_metatypes.json %%QT_LIBDIR%%/metatypes/qt6multimediawidgets_%%CMAKE_BUILD_TYPE%%_metatypes.json +%%GSTREAMER%%%%QT_LIBDIR%%/metatypes/qt6qgstreamermediapluginprivate_%%CMAKE_BUILD_TYPE%%_metatypes.json %%Q3D%%%%QT_LIBDIR%%/metatypes/qt6quick3dspatialaudioprivate_%%CMAKE_BUILD_TYPE%%_metatypes.json %%QT_LIBDIR%%/metatypes/qt6spatialaudio_%%CMAKE_BUILD_TYPE%%_metatypes.json %%QT_MKSPECDIR%%/modules/qt_lib_multimedia.pri @@ -291,6 +338,7 @@ lib/cmake/Qt6SpatialAudio/Qt6SpatialAudioVersionlessTargets.cmake %%QT_MKSPECDIR%%/modules/qt_lib_multimediaquick_private.pri %%QT_MKSPECDIR%%/modules/qt_lib_multimediawidgets.pri %%QT_MKSPECDIR%%/modules/qt_lib_multimediawidgets_private.pri +%%GSTREAMER%%%%QT_MKSPECDIR%%/modules/qt_lib_qgstreamermediaplugin_private.pri %%Q3D%%%%QT_MKSPECDIR%%/modules/qt_lib_quick3dspatialaudio_private.pri %%QT_MKSPECDIR%%/modules/qt_lib_spatialaudio.pri %%QT_MKSPECDIR%%/modules/qt_lib_spatialaudio_private.pri @@ -309,5 +357,6 @@ libdata/pkgconfig/Qt6SpatialAudio.pc %%QT_DATADIR%%/modules/Multimedia.json %%QT_DATADIR%%/modules/MultimediaQuickPrivate.json %%QT_DATADIR%%/modules/MultimediaWidgets.json +%%GSTREAMER%%%%QT_DATADIR%%/modules/QGstreamerMediaPluginPrivate.json %%Q3D%%%%QT_DATADIR%%/modules/Quick3DSpatialAudioPrivate.json %%QT_DATADIR%%/modules/SpatialAudio.json diff --git a/net/qt6-coap/distinfo b/net/qt6-coap/distinfo index 4dba11e699fb..3f22556b80fe 100644 --- a/net/qt6-coap/distinfo +++ b/net/qt6-coap/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712114578 -SHA256 (KDE/Qt/6.7.0/qt-qtcoap-v6.7.0_GH0.tar.gz) = fb3c8b7b49a642139840130a603c05f9d8413e963d644b0c897de863baad118e -SIZE (KDE/Qt/6.7.0/qt-qtcoap-v6.7.0_GH0.tar.gz) = 183108 +TIMESTAMP = 1716400397 +SHA256 (KDE/Qt/6.7.1/qt-qtcoap-v6.7.1_GH0.tar.gz) = d624777e8204996084c010dba7346df84e6b66e3d0e1156ce686da0bbec73d26 +SIZE (KDE/Qt/6.7.1/qt-qtcoap-v6.7.1_GH0.tar.gz) = 183915 diff --git a/net/qt6-networkauth/distinfo b/net/qt6-networkauth/distinfo index 81e9b9b96490..10981acd32bd 100644 --- a/net/qt6-networkauth/distinfo +++ b/net/qt6-networkauth/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712114580 -SHA256 (KDE/Qt/6.7.0/qtnetworkauth-everywhere-src-6.7.0.tar.xz) = 993105616ff0223d3d826e2a497440035721c6e1acdae232935fae3bcfa74a45 -SIZE (KDE/Qt/6.7.0/qtnetworkauth-everywhere-src-6.7.0.tar.xz) = 143660 +TIMESTAMP = 1716400399 +SHA256 (KDE/Qt/6.7.1/qtnetworkauth-everywhere-src-6.7.1.tar.xz) = 012b3a05c34f2cdd197bd209696493c9e8085daeaa36589fd791d449d841575d +SIZE (KDE/Qt/6.7.1/qtnetworkauth-everywhere-src-6.7.1.tar.xz) = 144184 diff --git a/science/qt6-quick3dphysics/distinfo b/science/qt6-quick3dphysics/distinfo index 593b62984e53..0555e50e13bf 100644 --- a/science/qt6-quick3dphysics/distinfo +++ b/science/qt6-quick3dphysics/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712114589 -SHA256 (KDE/Qt/6.7.0/qtquick3dphysics-everywhere-src-6.7.0.tar.xz) = 80045f261109f3f3807c0b405d056e935210a36499c3a9aff78296d8940e04e6 -SIZE (KDE/Qt/6.7.0/qtquick3dphysics-everywhere-src-6.7.0.tar.xz) = 4702492 +TIMESTAMP = 1716400405 +SHA256 (KDE/Qt/6.7.1/qtquick3dphysics-everywhere-src-6.7.1.tar.xz) = 2f0f51429883b08e5f5a6bd571185725af3fd47741665eadd47a121748cfbd75 +SIZE (KDE/Qt/6.7.1/qtquick3dphysics-everywhere-src-6.7.1.tar.xz) = 4703476 diff --git a/www/qt6-httpserver/distinfo b/www/qt6-httpserver/distinfo index 3034098790ec..f295bf244fe9 100644 --- a/www/qt6-httpserver/distinfo +++ b/www/qt6-httpserver/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712114591 -SHA256 (KDE/Qt/6.7.0/qthttpserver-everywhere-src-6.7.0.tar.xz) = c2e2e38b2b21537eeef20d097bb5f216081462c44b78d63045e60d6fd9f89bfa -SIZE (KDE/Qt/6.7.0/qthttpserver-everywhere-src-6.7.0.tar.xz) = 163044 +TIMESTAMP = 1716400407 +SHA256 (KDE/Qt/6.7.1/qthttpserver-everywhere-src-6.7.1.tar.xz) = ed20831ea20524c8d5e74a70dab7b59ae0ee3ccdc266ee5b7ffbf8147df4bbdb +SIZE (KDE/Qt/6.7.1/qthttpserver-everywhere-src-6.7.1.tar.xz) = 163700 diff --git a/www/qt6-webchannel/distinfo b/www/qt6-webchannel/distinfo index efd443f28aec..6f7afc07deba 100644 --- a/www/qt6-webchannel/distinfo +++ b/www/qt6-webchannel/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712114594 -SHA256 (KDE/Qt/6.7.0/qtwebchannel-everywhere-src-6.7.0.tar.xz) = 26bfbd404e0c82bfbeeaef81796eb7a7cf931c5c1a5e942a315ca7126322efff -SIZE (KDE/Qt/6.7.0/qtwebchannel-everywhere-src-6.7.0.tar.xz) = 206600 +TIMESTAMP = 1716400409 +SHA256 (KDE/Qt/6.7.1/qtwebchannel-everywhere-src-6.7.1.tar.xz) = b9d995edfce90bce04635305936e49a8ae61196d74bcce0f09d26b285d2dcc6f +SIZE (KDE/Qt/6.7.1/qtwebchannel-everywhere-src-6.7.1.tar.xz) = 206564 diff --git a/www/qt6-webengine/distinfo b/www/qt6-webengine/distinfo index a6a5a71622f1..b1397466ecde 100644 --- a/www/qt6-webengine/distinfo +++ b/www/qt6-webengine/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712115499 -SHA256 (KDE/Qt/6.7.0/qtwebengine-everywhere-src-6.7.0.tar.xz) = 1a5ba443635dc1f439ab802ac6d761b8def5ebb24e5219bb7289288e72c147de -SIZE (KDE/Qt/6.7.0/qtwebengine-everywhere-src-6.7.0.tar.xz) = 550907592 +TIMESTAMP = 1716400783 +SHA256 (KDE/Qt/6.7.1/qtwebengine-everywhere-src-6.7.1.tar.xz) = 53f08012609a7d949b0e951728ac2364a06466325ffd163b56a87c3fd021dc44 +SIZE (KDE/Qt/6.7.1/qtwebengine-everywhere-src-6.7.1.tar.xz) = 550975920 diff --git a/www/qt6-webengine/files/patch-security-rollup b/www/qt6-webengine/files/patch-security-rollup deleted file mode 100644 index a3d1a6bc69d2..000000000000 --- a/www/qt6-webengine/files/patch-security-rollup +++ /dev/null @@ -1,6091 +0,0 @@ -Add security patches to this file. - -Addresses the following security issues: - -- CVE-2023-7104 -- CVE-2024-2625 -- CVE-2024-2626 -- Security bug 40066823 -- Security bug 41495984 -- CVE-2024-2885 -- CVE-2024-2887 -- Security bug 329674887 -- Security bug 327183408 -- CVE-2024-3159 -- Security bug 326349405 -- CVE-2024-3157 -- CVE-2024-3516 -- Security bug 326521449 -- CVE-2024-3839 -- CVE-2024-3837 -- Security bug 327698060 -- Security bug 40940917 -- CVE-2024-3914 -- Security bug 326498393 -- CVE-2024-3840 -- Security bug 323898565 -- CVE-2024-4058 -- CVE-2024-4060 -- Security bug 332724843 -- CVE-2024-4331 -- CVE-2024-4368 -- CVE-2024-4671 -- Security bug 339458194 - -From b8c9622b71d032a48412e342cff91fc0f3f5e3d9 Mon Sep 17 00:00:00 2001 -From: Michal Klocek -Date: Tue, 19 Mar 2024 21:20:24 +0100 -Subject: [PATCH] CVE-2023-7104 - -Fix a buffer overread in the sessions extension -that could occur when processing a corrupt changeset. - -Backported from: -https://sqlite.org/src/info/0e4e7a05c4204b47 - -Change-Id: I670960f13234971f48e8837a3935495a0d69a026 -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/549500 -Reviewed-by: Allan Sandfeld Jensen -(cherry picked from commit 147f7790602ab5d43bfe19f759074258ca7e975b) -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/550068 -Reviewed-by: Qt Cherry-pick Bot ---- - .../sqlite/src/amalgamation/sqlite3.c | 18 +++++++++++------- - 1 file changed, 11 insertions(+), 7 deletions(-) - -diff --git a/chromium/third_party/sqlite/src/amalgamation/sqlite3.c b/chromium/third_party/sqlite/src/amalgamation/sqlite3.c -index b353aa88348..a0feb5d200c 100644 ---- src/3rdparty/chromium/third_party/sqlite/src/amalgamation/sqlite3.c -+++ src/3rdparty/chromium/third_party/sqlite/src/amalgamation/sqlite3.c -@@ -218682,15 +218682,19 @@ static int sessionReadRecord( - } - } - if( eType==SQLITE_INTEGER || eType==SQLITE_FLOAT ){ -- sqlite3_int64 v = sessionGetI64(aVal); -- if( eType==SQLITE_INTEGER ){ -- sqlite3VdbeMemSetInt64(apOut[i], v); -+ if( (pIn->nData-pIn->iNext)<8 ){ -+ rc = SQLITE_CORRUPT_BKPT; - }else{ -- double d; -- memcpy(&d, &v, 8); -- sqlite3VdbeMemSetDouble(apOut[i], d); -+ sqlite3_int64 v = sessionGetI64(aVal); -+ if( eType==SQLITE_INTEGER ){ -+ sqlite3VdbeMemSetInt64(apOut[i], v); -+ }else{ -+ double d; -+ memcpy(&d, &v, 8); -+ sqlite3VdbeMemSetDouble(apOut[i], d); -+ } -+ pIn->iNext += 8; - } -- pIn->iNext += 8; - } - } - } -From a907a6cbc18a04d791b0c97918a558d49f696cd4 Mon Sep 17 00:00:00 2001 -From: Shu-yu Guo -Date: Thu, 7 Mar 2024 14:55:28 -0800 -Subject: [PATCH] [Backport] CVE-2024-2625: Object lifecycle issue in V8 -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Manual cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/v8/v8/+/5350482: -Fix home object proxy to work off-thread - -Because the home object has special scope lookup rules due to class -heritage position, VariableProxies of the home object are currently -directly created on the correct scope during parsing. However, during -off-thread parsing the main thread is parked, and the correct scope -may try to dereference a main-thread Handle. - -This CL moves the logic into ResolveVariable instead, which happens -during postprocessing, with the main thread unparked. - -Fixed: chromium:327740539 -Change-Id: I3a123d5e37b6764067e58255dd5a67c07e648d02 -Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5350482 -Reviewed-by: Marja Hölttä -Commit-Queue: Marja Hölttä -Auto-Submit: Shu-yu Guo -Cr-Commit-Position: refs/heads/main@{#92722} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/551089 -Reviewed-by: Allan Sandfeld Jensen ---- - chromium/v8/src/ast/ast.h | 10 +++- - chromium/v8/src/ast/scopes.cc | 78 ++++++++++++--------------- - chromium/v8/src/ast/scopes.h | 7 +-- - chromium/v8/src/parsing/parser-base.h | 4 +- - chromium/v8/src/parsing/parser.cc | 11 ++-- - chromium/v8/src/parsing/parser.h | 2 +- - chromium/v8/src/parsing/preparser.h | 3 +- - 7 files changed, 52 insertions(+), 63 deletions(-) - -diff --git a/chromium/v8/src/ast/ast.h b/chromium/v8/src/ast/ast.h -index cf9d52eeed6..7bb30723607 100644 ---- src/3rdparty/chromium/v8/src/ast/ast.h -+++ src/3rdparty/chromium/v8/src/ast/ast.h -@@ -1534,6 +1534,12 @@ class VariableProxy final : public Expression { - bit_field_ = IsRemovedFromUnresolvedField::update(bit_field_, true); - } - -+ bool is_home_object() const { return IsHomeObjectField::decode(bit_field_); } -+ -+ void set_is_home_object() { -+ bit_field_ = IsHomeObjectField::update(bit_field_, true); -+ } -+ - // Provides filtered access to the unresolved variable proxy threaded list. - struct UnresolvedNext { - static VariableProxy** filter(VariableProxy** t) { -@@ -1565,6 +1571,7 @@ class VariableProxy final : public Expression { - bit_field_ |= IsAssignedField::encode(false) | - IsResolvedField::encode(false) | - IsRemovedFromUnresolvedField::encode(false) | -+ IsHomeObjectField::encode(false) | - HoleCheckModeField::encode(HoleCheckMode::kElided); - } - -@@ -1574,7 +1581,8 @@ class VariableProxy final : public Expression { - using IsResolvedField = IsAssignedField::Next; - using IsRemovedFromUnresolvedField = IsResolvedField::Next; - using IsNewTargetField = IsRemovedFromUnresolvedField::Next; -- using HoleCheckModeField = IsNewTargetField::Next; -+ using IsHomeObjectField = IsNewTargetField::Next; -+ using HoleCheckModeField = IsHomeObjectField::Next; - - union { - const AstRawString* raw_name_; // if !is_resolved_ -diff --git a/chromium/v8/src/ast/scopes.cc b/chromium/v8/src/ast/scopes.cc -index 003bd0f2736..34415941556 100644 ---- src/3rdparty/chromium/v8/src/ast/scopes.cc -+++ src/3rdparty/chromium/v8/src/ast/scopes.cc -@@ -491,7 +491,6 @@ Scope* Scope::DeserializeScopeChain(IsolateT* isolate, Zone* zone, - if (cache_scope_found) { - outer_scope->set_deserialized_scope_uses_external_cache(); - } else { -- DCHECK(!cache_scope_found); - cache_scope_found = - outer_scope->is_declaration_scope() && !outer_scope->is_eval_scope(); - } -@@ -970,9 +969,14 @@ Variable* Scope::LookupInScopeInfo(const AstRawString* name, Scope* cache) { - DCHECK(!cache->deserialized_scope_uses_external_cache()); - // The case where where the cache can be another scope is when the cache scope - // is the last scope that doesn't use an external cache. -+ // -+ // The one exception to this is when looking up the home object, which may -+ // skip multiple scopes that don't use an external cache (e.g., several arrow -+ // functions). - DCHECK_IMPLIES( - cache != this, -- cache->outer_scope()->deserialized_scope_uses_external_cache()); -+ cache->outer_scope()->deserialized_scope_uses_external_cache() || -+ cache->GetHomeObjectScope() == this); - DCHECK_NULL(cache->variables_.Lookup(name)); - DisallowGarbageCollection no_gc; - -@@ -2282,7 +2286,33 @@ Variable* Scope::LookupSloppyEval(VariableProxy* proxy, Scope* scope, - - void Scope::ResolveVariable(VariableProxy* proxy) { - DCHECK(!proxy->is_resolved()); -- Variable* var = Lookup(proxy, this, nullptr); -+ Variable* var; -+ if (V8_UNLIKELY(proxy->is_home_object())) { -+ // VariableProxies of the home object cannot be resolved like a normal -+ // variable. Consider the case of a super.property usage in heritage -+ // position: -+ // -+ // class C extends super.foo { m() { super.bar(); } } -+ // -+ // The super.foo property access is logically nested under C's class scope, -+ // which also has a home object due to its own method m's usage of -+ // super.bar(). However, super.foo must resolve super in C's outer scope. -+ // -+ // Because of the above, start resolving home objects directly at the home -+ // object scope instead of the current scope. -+ Scope* scope = GetDeclarationScope()->GetHomeObjectScope(); -+ DCHECK_NOT_NULL(scope); -+ if (scope->scope_info_.is_null()) { -+ var = Lookup(proxy, scope, nullptr); -+ } else { -+ Scope* entry_cache = scope->deserialized_scope_uses_external_cache() -+ ? GetNonEvalDeclarationScope() -+ : scope; -+ var = Lookup(proxy, scope, nullptr, entry_cache); -+ } -+ } else { -+ var = Lookup(proxy, this, nullptr); -+ } - DCHECK_NOT_NULL(var); - ResolveTo(proxy, var); - } -@@ -2752,48 +2782,6 @@ int Scope::ContextLocalCount() const { - (is_function_var_in_context ? 1 : 0); - } - --VariableProxy* Scope::NewHomeObjectVariableProxy(AstNodeFactory* factory, -- const AstRawString* name, -- int start_pos) { -- // VariableProxies of the home object cannot be resolved like a normal -- // variable. Consider the case of a super.property usage in heritage position: -- // -- // class C extends super.foo { m() { super.bar(); } } -- // -- // The super.foo property access is logically nested under C's class scope, -- // which also has a home object due to its own method m's usage of -- // super.bar(). However, super.foo must resolve super in C's outer scope. -- // -- // Because of the above, home object VariableProxies are always made directly -- // on the Scope that needs the home object instead of the innermost scope. -- DCHECK(needs_home_object()); -- if (!scope_info_.is_null()) { -- // This is a lazy compile, so the home object's context slot is already -- // known. -- Variable* home_object = variables_.Lookup(name); -- if (home_object == nullptr) { -- VariableLookupResult lookup_result; -- int index = scope_info_->ContextSlotIndex(name->string(), &lookup_result); -- DCHECK_GE(index, 0); -- bool was_added; -- home_object = variables_.Declare(zone(), this, name, lookup_result.mode, -- NORMAL_VARIABLE, lookup_result.init_flag, -- lookup_result.maybe_assigned_flag, -- IsStaticFlag::kNotStatic, &was_added); -- DCHECK(was_added); -- home_object->AllocateTo(VariableLocation::CONTEXT, index); -- } -- return factory->NewVariableProxy(home_object, start_pos); -- } -- // This is not a lazy compile. Add the unresolved home object VariableProxy to -- // the unresolved list of the home object scope, which is not necessarily the -- // innermost scope. -- VariableProxy* proxy = -- factory->NewVariableProxy(name, NORMAL_VARIABLE, start_pos); -- AddUnresolved(proxy); -- return proxy; --} -- - bool IsComplementaryAccessorPair(VariableMode a, VariableMode b) { - switch (a) { - case VariableMode::kPrivateGetterOnly: -diff --git a/chromium/v8/src/ast/scopes.h b/chromium/v8/src/ast/scopes.h -index b4c2e8b2136..751aaee3d11 100644 ---- src/3rdparty/chromium/v8/src/ast/scopes.h -+++ src/3rdparty/chromium/v8/src/ast/scopes.h -@@ -603,10 +603,6 @@ class V8_EXPORT_PRIVATE Scope : public NON_EXPORTED_BASE(ZoneObject) { - needs_home_object_ = true; - } - -- VariableProxy* NewHomeObjectVariableProxy(AstNodeFactory* factory, -- const AstRawString* name, -- int start_pos); -- - bool RemoveInnerScope(Scope* inner_scope) { - DCHECK_NOT_NULL(inner_scope); - if (inner_scope == inner_scope_) { -@@ -865,7 +861,7 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope { - FunctionKind function_kind() const { return function_kind_; } - - // Inform the scope that the corresponding code uses "super". -- Scope* RecordSuperPropertyUsage() { -+ void RecordSuperPropertyUsage() { - DCHECK(IsConciseMethod(function_kind()) || - IsAccessorFunction(function_kind()) || - IsClassConstructor(function_kind())); -@@ -873,7 +869,6 @@ class V8_EXPORT_PRIVATE DeclarationScope : public Scope { - Scope* home_object_scope = GetHomeObjectScope(); - DCHECK_NOT_NULL(home_object_scope); - home_object_scope->set_needs_home_object(); -- return home_object_scope; - } - - bool uses_super_property() const { return uses_super_property_; } -diff --git a/chromium/v8/src/parsing/parser-base.h b/chromium/v8/src/parsing/parser-base.h -index 66e531dfe78..714406f6aa5 100644 ---- src/3rdparty/chromium/v8/src/parsing/parser-base.h -+++ src/3rdparty/chromium/v8/src/parsing/parser-base.h -@@ -3800,9 +3800,9 @@ ParserBase::ParseSuperExpression() { - impl()->ReportMessage(MessageTemplate::kOptionalChainingNoSuper); - return impl()->FailureExpression(); - } -- Scope* home_object_scope = scope->RecordSuperPropertyUsage(); -+ scope->RecordSuperPropertyUsage(); - UseThis(); -- return impl()->NewSuperPropertyReference(home_object_scope, pos); -+ return impl()->NewSuperPropertyReference(pos); - } - // super() is only allowed in derived constructor. new super() is never - // allowed; it's reported as an error by -diff --git a/chromium/v8/src/parsing/parser.cc b/chromium/v8/src/parsing/parser.cc -index da16f85234d..5e4b2d0461a 100644 ---- src/3rdparty/chromium/v8/src/parsing/parser.cc -+++ src/3rdparty/chromium/v8/src/parsing/parser.cc -@@ -300,18 +300,17 @@ Expression* Parser::NewThrowError(Runtime::FunctionId id, - return factory()->NewThrow(call_constructor, pos); - } - --Expression* Parser::NewSuperPropertyReference(Scope* home_object_scope, -- int pos) { -+Expression* Parser::NewSuperPropertyReference(int pos) { - const AstRawString* home_object_name; - if (IsStatic(scope()->GetReceiverScope()->function_kind())) { - home_object_name = ast_value_factory_->dot_static_home_object_string(); - } else { - home_object_name = ast_value_factory_->dot_home_object_string(); - } -- return factory()->NewSuperPropertyReference( -- home_object_scope->NewHomeObjectVariableProxy(factory(), home_object_name, -- pos), -- pos); -+ -+ VariableProxy* proxy = NewUnresolved(home_object_name, pos); -+ proxy->set_is_home_object(); -+ return factory()->NewSuperPropertyReference(proxy, pos); - } - - Expression* Parser::NewSuperCallReference(int pos) { -diff --git a/chromium/v8/src/parsing/parser.h b/chromium/v8/src/parsing/parser.h -index 8aede5d6a2c..0e92f0350b5 100644 ---- src/3rdparty/chromium/v8/src/parsing/parser.h -+++ src/3rdparty/chromium/v8/src/parsing/parser.h -@@ -798,7 +798,7 @@ class V8_EXPORT_PRIVATE Parser : public NON_EXPORTED_BASE(ParserBase) { - return factory()->NewThisExpression(pos); - } - -- Expression* NewSuperPropertyReference(Scope* home_object_scope, int pos); -+ Expression* NewSuperPropertyReference(int pos); - Expression* NewSuperCallReference(int pos); - Expression* NewTargetExpression(int pos); - Expression* ImportMetaExpression(int pos); -diff --git a/chromium/v8/src/parsing/preparser.h b/chromium/v8/src/parsing/preparser.h -index 6c4996bd06b..2ca6b9ac407 100644 ---- src/3rdparty/chromium/v8/src/parsing/preparser.h -+++ src/3rdparty/chromium/v8/src/parsing/preparser.h -@@ -1536,8 +1536,7 @@ class PreParser : public ParserBase { - return PreParserExpression::This(); - } - -- V8_INLINE PreParserExpression -- NewSuperPropertyReference(Scope* home_object_scope, int pos) { -+ V8_INLINE PreParserExpression NewSuperPropertyReference(int pos) { - return PreParserExpression::Default(); - } - -From c4661dc646e45d06961cda71d00814ce878dbd97 Mon Sep 17 00:00:00 2001 -From: Shahbaz Youssefi -Date: Fri, 19 Jan 2024 15:36:25 -0500 -Subject: [PATCH] [Backport] CVE-2024-2626: Out of bounds read in Swiftshader - (1/2) - -Cherry-pick of patch originally reviewed on -https://swiftshader-review.googlesource.com/c/SwiftShader/+/72948: -Clamp LOD during image Fetch for robustness - -Bug: chromium:1504556 -Change-Id: Ie110fe4e1b065a815c09986ab91b1336ef4761ad -Reviewed-on: https://swiftshader-review.googlesource.com/c/SwiftShader/+/72948 -Presubmit-Ready: Shahbaz Youssefi -Kokoro-Result: kokoro -Reviewed-by: Ben Clayton -Commit-Queue: Ben Clayton -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/551090 -Reviewed-by: Allan Sandfeld Jensen ---- - .../third_party/swiftshader/src/Pipeline/SamplerCore.cpp | 1 + - .../swiftshader/src/Pipeline/SpirvShaderSampling.cpp | 5 +++++ - chromium/third_party/swiftshader/src/Vulkan/VkImageView.cpp | 6 ++++-- - chromium/third_party/swiftshader/src/Vulkan/VkImageView.hpp | 3 +++ - 4 files changed, 13 insertions(+), 2 deletions(-) - -diff --git a/chromium/third_party/swiftshader/src/Pipeline/SamplerCore.cpp b/chromium/third_party/swiftshader/src/Pipeline/SamplerCore.cpp -index 403ed3bdd560..d62936273fa3 100644 ---- src/3rdparty/chromium/third_party/swiftshader/src/Pipeline/SamplerCore.cpp -+++ src/3rdparty/chromium/third_party/swiftshader/src/Pipeline/SamplerCore.cpp -@@ -133,6 +133,7 @@ Vector4f SamplerCore::sampleTexture128(Pointer &texture, Float4 uvwa[4], c - { - // TODO: Eliminate int-float-int conversion. - lod = Float(As(lodOrBias)); -+ lod = Min(lod, state.maxLod); - } - else if(function == Base || function == Gather) - { -diff --git a/chromium/third_party/swiftshader/src/Pipeline/SpirvShaderSampling.cpp b/chromium/third_party/swiftshader/src/Pipeline/SpirvShaderSampling.cpp -index 5225a79f3ba6..777f73e43786 100644 ---- src/3rdparty/chromium/third_party/swiftshader/src/Pipeline/SpirvShaderSampling.cpp -+++ src/3rdparty/chromium/third_party/swiftshader/src/Pipeline/SpirvShaderSampling.cpp -@@ -108,6 +108,11 @@ SpirvEmitter::ImageSampler *SpirvEmitter::getImageSampler(const vk::Device *devi - samplerState.minLod = 0.0f; - samplerState.maxLod = 0.0f; - } -+ // Otherwise make sure LOD is clamped for robustness -+ else -+ { -+ samplerState.maxLod = imageViewState.maxLod; -+ } - } - else if(samplerMethod == Write) - { -diff --git a/chromium/third_party/swiftshader/src/Vulkan/VkImageView.cpp b/chromium/third_party/swiftshader/src/Vulkan/VkImageView.cpp -index 511c02cbbed9..26b69aef79b3 100644 ---- src/3rdparty/chromium/third_party/swiftshader/src/Vulkan/VkImageView.cpp -+++ src/3rdparty/chromium/third_party/swiftshader/src/Vulkan/VkImageView.cpp -@@ -89,13 +89,13 @@ Identifier::Identifier(const VkImageViewCreateInfo *pCreateInfo) - const Image *sampledImage = image->getSampledImage(viewFormat); - - vk::Format samplingFormat = (image == sampledImage) ? viewFormat : sampledImage->getFormat().getAspectFormat(subresource.aspectMask); -- pack({ pCreateInfo->viewType, samplingFormat, ResolveComponentMapping(pCreateInfo->components, viewFormat), subresource.levelCount <= 1u }); -+ pack({ pCreateInfo->viewType, samplingFormat, ResolveComponentMapping(pCreateInfo->components, viewFormat), static_cast(subresource.baseMipLevel + subresource.levelCount), subresource.levelCount <= 1u }); - } - - Identifier::Identifier(VkFormat bufferFormat) - { - constexpr VkComponentMapping identityMapping = { VK_COMPONENT_SWIZZLE_R, VK_COMPONENT_SWIZZLE_G, VK_COMPONENT_SWIZZLE_B, VK_COMPONENT_SWIZZLE_A }; -- pack({ VK_IMAGE_VIEW_TYPE_1D, bufferFormat, ResolveComponentMapping(identityMapping, bufferFormat), true }); -+ pack({ VK_IMAGE_VIEW_TYPE_1D, bufferFormat, ResolveComponentMapping(identityMapping, bufferFormat), 1, true }); - } - - void Identifier::pack(const State &state) -@@ -106,6 +106,7 @@ void Identifier::pack(const State &state) - g = static_cast(state.mapping.g); - b = static_cast(state.mapping.b); - a = static_cast(state.mapping.a); -+ maxLod = state.maxLod; - singleMipLevel = state.singleMipLevel; - } - -@@ -117,6 +118,7 @@ Identifier::State Identifier::getState() const - static_cast(g), - static_cast(b), - static_cast(a) }, -+ static_cast(maxLod), - static_cast(singleMipLevel) }; - } - -diff --git a/chromium/third_party/swiftshader/src/Vulkan/VkImageView.hpp b/chromium/third_party/swiftshader/src/Vulkan/VkImageView.hpp -index bf4d666a425d..5acb89639c12 100644 ---- src/3rdparty/chromium/third_party/swiftshader/src/Vulkan/VkImageView.hpp -+++ src/3rdparty/chromium/third_party/swiftshader/src/Vulkan/VkImageView.hpp -@@ -53,6 +53,7 @@ union Identifier - VkImageViewType imageViewType; - VkFormat format; - VkComponentMapping mapping; -+ uint8_t maxLod; - bool singleMipLevel; - }; - State getState() const; -@@ -61,6 +62,7 @@ union Identifier - void pack(const State &data); - - // Identifier is a union of this struct and the integer below. -+ static_assert(sw::MIPMAP_LEVELS <= 15); - struct - { - uint32_t imageViewType : 3; -@@ -69,6 +71,7 @@ union Identifier - uint32_t g : 3; - uint32_t b : 3; - uint32_t a : 3; -+ uint32_t maxLod : 4; - uint32_t singleMipLevel : 1; - }; - -From a58826b55d30045bed8793dbcd20dc32a73716e2 Mon Sep 17 00:00:00 2001 -From: Shahbaz Youssefi -Date: Mon, 22 Jan 2024 09:49:16 -0500 -Subject: [PATCH] [Backport] CVE-2024-2626: Out of bounds read in Swiftshader - (2/2) - -Cherry-pick of patch originally reviewed on -https://swiftshader-review.googlesource.com/c/SwiftShader/+/72968: -Clamp min LOD during image Fetch for robustness - -The previous change clamped max LOD only, but min LOD also needs -clamping because texelFetch takes an `int` as LOD instead of `uint`. - -Bug: chromium:1504556 -Change-Id: Ibae8250a877b3e04b71fac45a40b77c78756d6c8 -Reviewed-on: https://swiftshader-review.googlesource.com/c/SwiftShader/+/72968 -Kokoro-Result: kokoro -Reviewed-by: Ben Clayton -Commit-Queue: Shahbaz Youssefi -Presubmit-Ready: Shahbaz Youssefi -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/551091 -Reviewed-by: Allan Sandfeld Jensen ---- - .../third_party/swiftshader/src/Pipeline/SamplerCore.cpp | 1 + - .../swiftshader/src/Pipeline/SpirvShaderSampling.cpp | 1 + - .../third_party/swiftshader/src/Vulkan/VkImageView.cpp | 8 ++++++-- - .../third_party/swiftshader/src/Vulkan/VkImageView.hpp | 2 ++ - 4 files changed, 10 insertions(+), 2 deletions(-) - -diff --git a/chromium/third_party/swiftshader/src/Pipeline/SamplerCore.cpp b/chromium/third_party/swiftshader/src/Pipeline/SamplerCore.cpp -index d62936273fa..ab55c036a3f 100644 ---- src/3rdparty/chromium/third_party/swiftshader/src/Pipeline/SamplerCore.cpp -+++ src/3rdparty/chromium/third_party/swiftshader/src/Pipeline/SamplerCore.cpp -@@ -133,6 +133,7 @@ Vector4f SamplerCore::sampleTexture128(Pointer &texture, Float4 uvwa[4], c - { - // TODO: Eliminate int-float-int conversion. - lod = Float(As(lodOrBias)); -+ lod = Max(lod, state.minLod); - lod = Min(lod, state.maxLod); - } - else if(function == Base || function == Gather) -diff --git a/chromium/third_party/swiftshader/src/Pipeline/SpirvShaderSampling.cpp b/chromium/third_party/swiftshader/src/Pipeline/SpirvShaderSampling.cpp -index 777f73e4378..fa88a192ab5 100644 ---- src/3rdparty/chromium/third_party/swiftshader/src/Pipeline/SpirvShaderSampling.cpp -+++ src/3rdparty/chromium/third_party/swiftshader/src/Pipeline/SpirvShaderSampling.cpp -@@ -111,6 +111,7 @@ SpirvEmitter::ImageSampler *SpirvEmitter::getImageSampler(const vk::Device *devi - // Otherwise make sure LOD is clamped for robustness - else - { -+ samplerState.minLod = imageViewState.minLod; - samplerState.maxLod = imageViewState.maxLod; - } - } -diff --git a/chromium/third_party/swiftshader/src/Vulkan/VkImageView.cpp b/chromium/third_party/swiftshader/src/Vulkan/VkImageView.cpp -index 26b69aef79b..1b25544a57b 100644 ---- src/3rdparty/chromium/third_party/swiftshader/src/Vulkan/VkImageView.cpp -+++ src/3rdparty/chromium/third_party/swiftshader/src/Vulkan/VkImageView.cpp -@@ -89,13 +89,15 @@ Identifier::Identifier(const VkImageViewCreateInfo *pCreateInfo) - const Image *sampledImage = image->getSampledImage(viewFormat); - - vk::Format samplingFormat = (image == sampledImage) ? viewFormat : sampledImage->getFormat().getAspectFormat(subresource.aspectMask); -- pack({ pCreateInfo->viewType, samplingFormat, ResolveComponentMapping(pCreateInfo->components, viewFormat), static_cast(subresource.baseMipLevel + subresource.levelCount), subresource.levelCount <= 1u }); -+ pack({ pCreateInfo->viewType, samplingFormat, ResolveComponentMapping(pCreateInfo->components, viewFormat), -+ static_cast(subresource.baseMipLevel), -+ static_cast(subresource.baseMipLevel + subresource.levelCount), subresource.levelCount <= 1u }); - } - - Identifier::Identifier(VkFormat bufferFormat) - { - constexpr VkComponentMapping identityMapping = { VK_COMPONENT_SWIZZLE_R, VK_COMPONENT_SWIZZLE_G, VK_COMPONENT_SWIZZLE_B, VK_COMPONENT_SWIZZLE_A }; -- pack({ VK_IMAGE_VIEW_TYPE_1D, bufferFormat, ResolveComponentMapping(identityMapping, bufferFormat), 1, true }); -+ pack({ VK_IMAGE_VIEW_TYPE_1D, bufferFormat, ResolveComponentMapping(identityMapping, bufferFormat), 0, 1, true }); - } - - void Identifier::pack(const State &state) -@@ -106,6 +108,7 @@ void Identifier::pack(const State &state) - g = static_cast(state.mapping.g); - b = static_cast(state.mapping.b); - a = static_cast(state.mapping.a); -+ minLod = state.minLod; - maxLod = state.maxLod; - singleMipLevel = state.singleMipLevel; - } -@@ -118,6 +121,7 @@ Identifier::State Identifier::getState() const - static_cast(g), - static_cast(b), - static_cast(a) }, -+ static_cast(minLod), - static_cast(maxLod), - static_cast(singleMipLevel) }; - } -diff --git a/chromium/third_party/swiftshader/src/Vulkan/VkImageView.hpp b/chromium/third_party/swiftshader/src/Vulkan/VkImageView.hpp -index 5acb89639c1..25feebc9e7e 100644 ---- src/3rdparty/chromium/third_party/swiftshader/src/Vulkan/VkImageView.hpp -+++ src/3rdparty/chromium/third_party/swiftshader/src/Vulkan/VkImageView.hpp -@@ -53,6 +53,7 @@ union Identifier - VkImageViewType imageViewType; - VkFormat format; - VkComponentMapping mapping; -+ uint8_t minLod; - uint8_t maxLod; - bool singleMipLevel; - }; -@@ -71,6 +72,7 @@ union Identifier - uint32_t g : 3; - uint32_t b : 3; - uint32_t a : 3; -+ uint32_t minLod : 4; - uint32_t maxLod : 4; - uint32_t singleMipLevel : 1; - }; -From 336b5c4a31f9f976434adb2ecf1697c764f097cf Mon Sep 17 00:00:00 2001 -From: rajendrant -Date: Fri, 9 Feb 2024 17:29:51 +0000 -Subject: [PATCH] [Backport] Security bug 40066823 - -Manual partial backport of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5279279: -Remove holding local_state in model store - -Avoids holding on to local_state in model store, by getting the local state when needed from chrome/. This delinks model store lifetime with local state lifetime. - -Change-Id: Ifb036b43b8394202683d4ae1131ff1eae780fc17 -Fixed: 40066823 -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5279279 -Reviewed-by: Sophie Chang -Commit-Queue: Raj T -Reviewed-by: Trevor Perrier -Cr-Commit-Position: refs/heads/main@{#1258580} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/551092 -Reviewed-by: Allan Sandfeld Jensen ---- - .../core/prediction_model_store.cc | 61 ++++++------------- - .../core/prediction_model_store.h | 28 +++------ - 2 files changed, 28 insertions(+), 61 deletions(-) - -diff --git a/chromium/components/optimization_guide/core/prediction_model_store.cc b/chromium/components/optimization_guide/core/prediction_model_store.cc -index d2252ea5cc4..a399ac06d7f 100644 ---- src/3rdparty/chromium/components/optimization_guide/core/prediction_model_store.cc -+++ src/3rdparty/chromium/components/optimization_guide/core/prediction_model_store.cc -@@ -155,12 +155,6 @@ void RecordModelStorageMetrics(const base::FilePath& base_store_dir) { - - } // namespace - --// static --PredictionModelStore* PredictionModelStore::GetInstance() { -- static base::NoDestructor model_store; -- return model_store.get(); --} -- - PredictionModelStore::PredictionModelStore() - : background_task_runner_(base::ThreadPool::CreateSequencedTaskRunner( - {base::MayBlock(), base::TaskPriority::BEST_EFFORT})) { -@@ -169,19 +163,14 @@ PredictionModelStore::PredictionModelStore() - - PredictionModelStore::~PredictionModelStore() = default; - --void PredictionModelStore::Initialize(PrefService* local_state, -- const base::FilePath& base_store_dir) { -+void PredictionModelStore::Initialize(const base::FilePath& base_store_dir) { - DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); -- DCHECK(local_state); - DCHECK(!base_store_dir.empty()); - - // Should not be initialized already. -- DCHECK(!local_state_); - DCHECK(base_store_dir_.empty()); - -- local_state_ = local_state; - base_store_dir_ = base_store_dir; -- - PurgeInactiveModels(); - - // Clean up any model files that were slated for deletion in previous -@@ -189,29 +178,19 @@ void PredictionModelStore::Initialize(PrefService* local_state, - CleanUpOldModelFiles(); - - background_task_runner_->PostTask( -- FROM_HERE, -- base::BindOnce(&RemoveInvalidModelDirs, base_store_dir_, -- ModelStoreMetadataEntry::GetValidModelDirs(local_state_))); -+ FROM_HERE, base::BindOnce(&RemoveInvalidModelDirs, base_store_dir_, -+ ModelStoreMetadataEntry::GetValidModelDirs( -+ GetLocalState()))); - background_task_runner_->PostTask( - FROM_HERE, base::BindOnce(&RecordModelStorageMetrics, base_store_dir_)); - } - --// static --std::unique_ptr --PredictionModelStore::CreatePredictionModelStoreForTesting( -- PrefService* local_state, -- const base::FilePath& base_store_dir) { -- auto store = base::WrapUnique(new PredictionModelStore()); -- store->Initialize(local_state, base_store_dir); -- return store; --} -- - bool PredictionModelStore::HasModel( - proto::OptimizationTarget optimization_target, - const proto::ModelCacheKey& model_cache_key) const { - DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); - auto metadata = ModelStoreMetadataEntry::GetModelMetadataEntryIfExists( -- local_state_, optimization_target, model_cache_key); -+ GetLocalState(), optimization_target, model_cache_key); - if (!metadata) { - return false; - } -@@ -226,7 +205,7 @@ bool PredictionModelStore::HasModelWithVersion( - int64_t version) { - DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); - auto metadata = ModelStoreMetadataEntry::GetModelMetadataEntryIfExists( -- local_state_, optimization_target, model_cache_key); -+ GetLocalState(), optimization_target, model_cache_key); - if (!metadata) { - return false; - } -@@ -251,7 +230,7 @@ void PredictionModelStore::LoadModel( - DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); - - auto metadata = ModelStoreMetadataEntry::GetModelMetadataEntryIfExists( -- local_state_, optimization_target, model_cache_key); -+ GetLocalState(), optimization_target, model_cache_key); - if (!metadata) { - std::move(callback).Run(nullptr); - return; -@@ -334,7 +313,7 @@ void PredictionModelStore::UpdateMetadataForExistingModel( - if (!HasModel(optimization_target, model_cache_key)) - return; - -- ModelStoreMetadataEntryUpdater metadata(local_state_, optimization_target, -+ ModelStoreMetadataEntryUpdater metadata(GetLocalState(), optimization_target, - model_cache_key); - DCHECK(!metadata.GetModelBaseDir()->IsAbsolute()); - metadata.SetVersion(model_info.version()); -@@ -357,7 +336,7 @@ void PredictionModelStore::UpdateModel( - DCHECK_EQ(optimization_target, model_info.optimization_target()); - DCHECK(base_store_dir_.IsParent(base_model_dir)); - -- ModelStoreMetadataEntryUpdater metadata(local_state_, optimization_target, -+ ModelStoreMetadataEntryUpdater metadata(GetLocalState(), optimization_target, - model_cache_key); - metadata.SetVersion(model_info.version()); - metadata.SetExpiryTime( -@@ -420,7 +399,7 @@ void PredictionModelStore::UpdateModelCacheKeyMapping( - const proto::ModelCacheKey& server_model_cache_key) { - DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); - ModelStoreMetadataEntryUpdater::UpdateModelCacheKeyMapping( -- local_state_, optimization_target, client_model_cache_key, -+ GetLocalState(), optimization_target, client_model_cache_key, - server_model_cache_key); - } - -@@ -429,13 +408,13 @@ void PredictionModelStore::RemoveModel( - const proto::ModelCacheKey& model_cache_key, - PredictionModelStoreModelRemovalReason model_remove_reason) { - DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); -- if (!local_state_) { -+ if (!GetLocalState()) { - return; - } - - RecordPredictionModelStoreModelRemovalVersionHistogram(optimization_target, - model_remove_reason); -- ModelStoreMetadataEntryUpdater metadata(local_state_, optimization_target, -+ ModelStoreMetadataEntryUpdater metadata(GetLocalState(), optimization_target, - model_cache_key); - auto base_model_dir = metadata.GetModelBaseDir(); - if (base_model_dir) { -@@ -458,16 +437,17 @@ void PredictionModelStore::ScheduleModelDirRemoval( - base_model_dir.IsAbsolute() - ? ConvertToRelativePath(base_store_dir_, base_model_dir) - : base_model_dir; -- ScopedDictPrefUpdate pref_update(local_state_, -+ ScopedDictPrefUpdate pref_update(GetLocalState(), - prefs::localstate::kStoreFilePathsToDelete); - pref_update->Set(FilePathToString(relative_model_dir), true); - } - - void PredictionModelStore::PurgeInactiveModels() { - DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); -- DCHECK(local_state_); -+ DCHECK(GetLocalState()); - for (const auto& expired_model_dir : -- ModelStoreMetadataEntryUpdater::PurgeAllInactiveMetadata(local_state_)) { -+ ModelStoreMetadataEntryUpdater::PurgeAllInactiveMetadata( -+ GetLocalState())) { - // Backward compatibility: Model dirs were absolute in the earlier versions, - // and it was only in experiment. The latest versions use relative paths. - DCHECK(!expired_model_dir.IsAbsolute() || -@@ -485,9 +465,9 @@ void PredictionModelStore::PurgeInactiveModels() { - - void PredictionModelStore::CleanUpOldModelFiles() { - DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); -- DCHECK(local_state_); -+ DCHECK(GetLocalState()); - for (const auto entry : -- local_state_->GetDict(prefs::localstate::kStoreFilePathsToDelete)) { -+ GetLocalState()->GetDict(prefs::localstate::kStoreFilePathsToDelete)) { - // Backward compatibility: Model dirs were absolute in the earlier versions. - // The latest versions use relative paths. - auto path_to_delete = StringToFilePath(entry.first); -@@ -508,13 +488,13 @@ void PredictionModelStore::CleanUpOldModelFiles() { - void PredictionModelStore::OnFilePathDeleted(const std::string& path_to_delete, - bool success) { - DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); -- DCHECK(local_state_); -+ DCHECK(GetLocalState()); - if (!success) { - // Try to delete again later. - return; - } - -- ScopedDictPrefUpdate pref_update(local_state_, -+ ScopedDictPrefUpdate pref_update(GetLocalState(), - prefs::localstate::kStoreFilePathsToDelete); - pref_update->Remove(path_to_delete); - } -@@ -527,7 +507,6 @@ base::FilePath PredictionModelStore::GetBaseStoreDirForTesting() const { - void PredictionModelStore::ResetForTesting() { - DETACH_FROM_SEQUENCE(sequence_checker_); - DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); -- local_state_ = nullptr; - base_store_dir_ = base::FilePath(); - background_task_runner_ = base::ThreadPool::CreateSequencedTaskRunner( - {base::MayBlock(), base::TaskPriority::BEST_EFFORT}); -diff --git a/chromium/components/optimization_guide/core/prediction_model_store.h b/chromium/components/optimization_guide/core/prediction_model_store.h -index eb39780fd37..720e50dc128 100644 ---- src/3rdparty/chromium/components/optimization_guide/core/prediction_model_store.h -+++ src/3rdparty/chromium/components/optimization_guide/core/prediction_model_store.h -@@ -8,7 +8,6 @@ - #include "base/files/file_path.h" - #include "base/memory/scoped_refptr.h" - #include "base/memory/weak_ptr.h" --#include "base/no_destructor.h" - #include "base/sequence_checker.h" - #include "base/task/sequenced_task_runner.h" - #include "base/values.h" -@@ -34,21 +33,15 @@ class PredictionModelStore { - using PredictionModelLoadedCallback = - base::OnceCallback)>; - -- // Returns the singleton model store. -- static PredictionModelStore* GetInstance(); -- -- static std::unique_ptr -- CreatePredictionModelStoreForTesting(PrefService* local_state, -- const base::FilePath& base_store_dir); -+ PredictionModelStore(); - -- // Initializes the model store with |local_state| and the |base_store_dir|. -- // Model store will be usable only after it is initialized. -- void Initialize(PrefService* local_state, -- const base::FilePath& base_store_dir); -+ // Initializes the model store with |base_store_dir|. Model store will be -+ // usable only after it is initialized. -+ void Initialize(const base::FilePath& base_store_dir); - - PredictionModelStore(const PredictionModelStore&) = delete; - PredictionModelStore& operator=(const PredictionModelStore&) = delete; -- ~PredictionModelStore(); -+ virtual ~PredictionModelStore(); - - // Initializes the model store with |local_state| and the |base_store_dir|, if - // initialization hasn't happened already. Model store will be usable only -@@ -111,6 +104,9 @@ class PredictionModelStore { - const proto::ModelCacheKey& model_cache_key, - PredictionModelStoreModelRemovalReason model_removal_reason); - -+ // Returns the local state that stores the prefs across all profiles. -+ virtual PrefService* GetLocalState() const = 0; -+ - base::FilePath GetBaseStoreDirForTesting() const; - - // Allows tests to reset the store for subsequent tests since the store is a -@@ -118,11 +114,8 @@ class PredictionModelStore { - void ResetForTesting(); - - private: -- friend base::NoDestructor; - friend class PredictionModelStoreBrowserTestBase; - -- PredictionModelStore(); -- - // Loads the model and verifies if the model files exist and returns the - // model. Otherwise nullptr is returned on any failures. - static std::unique_ptr -@@ -159,11 +152,6 @@ class PredictionModelStore { - // Invoked when model files gets deleted. - void OnFilePathDeleted(const std::string& path_to_delete, bool success); - -- // Local state that stores the prefs across all profiles. Not owned and -- // outlives |this|. -- raw_ptr local_state_ -- GUARDED_BY_CONTEXT(sequence_checker_) = nullptr; -- - // The base dir where the prediction model dirs are saved. - base::FilePath base_store_dir_ GUARDED_BY_CONTEXT(sequence_checker_); - -From ce8633a185cd8c2e819898d3a6cba63d1e8089c4 Mon Sep 17 00:00:00 2001 -From: John Stiles -Date: Wed, 31 Jan 2024 14:28:47 +0000 -Subject: [PATCH] [Backport] Security bug 41495984 - -Cherry-pick of patch originally reviewed on: -https://chromium-review.googlesource.com/c/chromium/src/+/5249171 -Improve handling of malformed BMP palettes. - -Add CHECKs to guarantee that clr_used is reasonably sized when -ProcessColorTable() is called. Out-of-bounds values are capped -by ProcessInfoHeader() already, but since this happens at a -distance, it's better to be sure. - -Additionally, we would previously add padding elements to a -palette if it was shorter than expected. We already had bounds -checks at the places where the palette was accessed, so we now -rely on those checks instead. - -Bug: 1523030 -Change-Id: I579c67d1029e1effba2036e9ec0c871418b140e2 -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5249171 -Commit-Queue: John Stiles -Reviewed-by: Peter Kasting -Auto-Submit: John Stiles -Cr-Commit-Position: refs/heads/main@{#1254490} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/551093 -Reviewed-by: Allan Sandfeld Jensen ---- - .../image-decoders/bmp/bmp_image_reader.cc | 25 ++++++++++--------- - 1 file changed, 13 insertions(+), 12 deletions(-) - -diff --git a/chromium/third_party/blink/renderer/platform/image-decoders/bmp/bmp_image_reader.cc b/chromium/third_party/blink/renderer/platform/image-decoders/bmp/bmp_image_reader.cc -index b7bbbf51a1b..9c319b4be01 100644 ---- src/3rdparty/chromium/third_party/blink/renderer/platform/image-decoders/bmp/bmp_image_reader.cc -+++ src/3rdparty/chromium/third_party/blink/renderer/platform/image-decoders/bmp/bmp_image_reader.cc -@@ -774,24 +774,31 @@ bool BMPImageReader::ProcessColorTable() { - - const wtf_size_t header_end = header_offset_ + info_header_.size; - wtf_size_t colors_in_palette = info_header_.clr_used; -+ CHECK_LE(colors_in_palette, 256u); // Enforced by ProcessInfoHeader(). - wtf_size_t table_size_in_bytes = colors_in_palette * bytes_per_color; - const wtf_size_t table_end = header_end + table_size_in_bytes; - if (table_end < header_end) { - return parent_->SetFailed(); - } - -- // Some BMPs don't contain a complete palette. Avoid reading off the end. -+ // Some BMPs don't contain a complete palette. Truncate it instead of reading -+ // off the end of the palette. - if (img_data_offset_ && (img_data_offset_ < table_end)) { -- colors_in_palette = (img_data_offset_ - header_end) / bytes_per_color; -+ wtf_size_t colors_in_truncated_palette = -+ (img_data_offset_ - header_end) / bytes_per_color; -+ CHECK_LE(colors_in_truncated_palette, colors_in_palette); -+ colors_in_palette = colors_in_truncated_palette; - table_size_in_bytes = colors_in_palette * bytes_per_color; - } - -- // Read color table. -+ // If we don't have enough data to read in the whole palette yet, stop here. - if ((decoded_offset_ > data_->size()) || - ((data_->size() - decoded_offset_) < table_size_in_bytes)) { - return false; - } -- color_table_.resize(info_header_.clr_used); -+ -+ // Read the color table. -+ color_table_.resize(colors_in_palette); - - for (wtf_size_t i = 0; i < colors_in_palette; ++i) { - color_table_[i].rgb_blue = ReadUint8(0); -@@ -799,12 +806,6 @@ bool BMPImageReader::ProcessColorTable() { - color_table_[i].rgb_red = ReadUint8(2); - decoded_offset_ += bytes_per_color; - } -- // Explicitly zero any colors past the end of a truncated palette. -- for (wtf_size_t i = colors_in_palette; i < info_header_.clr_used; ++i) { -- color_table_[i].rgb_blue = 0; -- color_table_[i].rgb_green = 0; -- color_table_[i].rgb_red = 0; -- } - - // We've now decoded all the non-image data we care about. Skip anything - // else before the actual raster data. -@@ -992,7 +993,7 @@ BMPImageReader::ProcessingResult BMPImageReader::ProcessRLEData() { - for (wtf_size_t which = 0; coord_.x() < end_x;) { - // Some images specify color values past the end of the - // color table; set these pixels to black. -- if (color_indexes[which] < info_header_.clr_used) { -+ if (color_indexes[which] < color_table_.size()) { - SetI(color_indexes[which]); - } else { - SetRGBA(0, 0, 0, 255); -@@ -1071,7 +1072,7 @@ BMPImageReader::ProcessingResult BMPImageReader::ProcessNonRLEData( - } - } else { - // See comments near the end of ProcessRLEData(). -- if (color_index < info_header_.clr_used) { -+ if (color_index < color_table_.size()) { - SetI(color_index); - } else { - SetRGBA(0, 0, 0, 255); -From 4349868d9af8ef7175125f53e441b12df5a22927 Mon Sep 17 00:00:00 2001 -From: Antonio Maiorano -Date: Wed, 20 Mar 2024 17:15:40 -0400 -Subject: [PATCH] [Backport] CVE-2024-2885: Use after free in Dawn - -Manual cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/external/github.com/microsoft/DirectXShaderCompiler/+/5383595: -Fix HLMatrixLowerPass leaving call to dangling FunctionVal - -When lowering an hl.cast, when the operand was an undef matrix, the pass would insert a call to a mat2vec stub, but since the undef value is not -an alloca, it never gets handled, and the call to the temporary stub -remains. Since the stub FunctionVal gets deleted, when the instruction -is accessed in a future pass, it reads a dangling pointer. - -The fix is to handle undef similarly to how constant 0 is handled, and -to return an undef vector from lowerHLCast. - -Bug: chromium:328958020 -Change-Id: Id31e3aa326d9cb9f03ea97139f14dc5292cd6f7b -Reviewed-on: https://chromium-review.googlesource.com/c/external/github.com/microsoft/DirectXShaderCompiler/+/5383595 -Reviewed-by: Ben Clayton -Reviewed-by: David Neto -Reviewed-by: Kenneth Russell -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/553291 -Reviewed-by: Michal Klocek ---- - .../dawn/third_party/dxc/lib/HLSL/HLMatrixLowerPass.cpp | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/chromium/third_party/dawn/third_party/dxc/lib/HLSL/HLMatrixLowerPass.cpp b/chromium/third_party/dawn/third_party/dxc/lib/HLSL/HLMatrixLowerPass.cpp -index e35ff832ecf..c3a7254ef2b 100644 ---- src/3rdparty/chromium/third_party/dawn/third_party/dxc/lib/HLSL/HLMatrixLowerPass.cpp -+++ src/3rdparty/chromium/third_party/dawn/third_party/dxc/lib/HLSL/HLMatrixLowerPass.cpp -@@ -381,6 +381,11 @@ Value* HLMatrixLowerPass::getLoweredByValOperand(Value *Val, IRBuilder<> &Builde - if (isa(Val)) - return ConstantAggregateZero::get(LoweredTy); - -+ // Lower undef mat as undef vec -+ if (isa(Val)) { -+ return UndefValue::get(LoweredTy); -+ } -+ - // Return a mat-to-vec translation stub - FunctionType *TranslationStubTy = FunctionType::get(LoweredTy, { Ty }, /* isVarArg */ false); - Function *TranslationStub = m_matToVecStubs->get(TranslationStubTy); -From 0c7f8cd69b6065fbc9a2af8927182ffe529e052e Mon Sep 17 00:00:00 2001 -From: Manos Koukoutos -Date: Thu, 21 Mar 2024 11:38:08 +0100 -Subject: [PATCH] [Backport] CVE-2024-2887: Type Confusion in WebAssembly - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/v8/v8/+/5380190: -Merged: [wasm] Check for type-definition count limit - -(cherry picked from commit b852ad701db21d6db5b34e66f4ec1cdccd2ec4d4) - -Bug: chromium:330575498 -Change-Id: I395f0ed6d823b7d1e139da6551486e3627d65724 -Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5378419 -Commit-Queue: Jakob Kummerow -Reviewed-by: Jakob Kummerow -Auto-Submit: Manos Koukoutos -Cr-Original-Commit-Position: refs/heads/main@{#92941} -Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5380190 -Reviewed-by: Francis McCabe -Commit-Queue: Adam Klein -Reviewed-by: Adam Klein -Cr-Commit-Position: refs/branch-heads/12.2@{#50} -Cr-Branched-From: 6eb5a9616aa6f8c705217aeb7c7ab8c037a2f676-refs/heads/12.2.281@{#1} -Cr-Branched-From: 44cf56d850167c6988522f8981730462abc04bcc-refs/heads/main@{#91934} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/553292 -Reviewed-by: Michal Klocek ---- - chromium/v8/src/wasm/module-decoder-impl.h | 5 +++++ - 1 file changed, 5 insertions(+) - -diff --git a/chromium/v8/src/wasm/module-decoder-impl.h b/chromium/v8/src/wasm/module-decoder-impl.h -index 97554288b55..75ca3a630a2 100644 ---- src/3rdparty/chromium/v8/src/wasm/module-decoder-impl.h -+++ src/3rdparty/chromium/v8/src/wasm/module-decoder-impl.h -@@ -687,6 +687,11 @@ class ModuleDecoderImpl : public Decoder { - } - } else { - if (tracer_) tracer_->TypeOffset(pc_offset()); -+ if (initial_size + 1 > kV8MaxWasmTypes) { -+ errorf(pc(), "Type definition count exceeds maximum %zu", -+ kV8MaxWasmTypes); -+ return; -+ } - // Similarly to above, we need to resize types for a group of size 1. - module_->types.resize(initial_size + 1); - module_->isorecursive_canonical_type_ids.resize(initial_size + 1); -From d414fd5b22455b7fcbddfdee22cf2b1f446ce3c4 Mon Sep 17 00:00:00 2001 -From: Marco Paniconi -Date: Wed, 13 Mar 2024 10:58:17 -0700 -Subject: [PATCH] [Backport] Security bug 329674887 (1/2) - -Cherry-pick of patch orignally reviewed on -https://chromium-review.googlesource.com/c/webm/libvpx/+/5370376: -Fix to buffer alloc for vp9_bitstream_worker_data - -The code was using the bitstream_worker_data when it -wasn't allocated for big enough size. This is because -the existing condition was to only re-alloc the -bitstream_worker_data when current dest_size was larger -than the current frame_size. But under resolution change -where frame_size is increased, beyond the current dest_size, -we need to allow re-alloc to the new size. - -The existing condition to re-alloc when dest_size is -larger than frame_size (which is not required) is kept -for now. - -Also increase the dest_size to account for image format. - -Added tests, for both ROW_MT=0 and 1, that reproduce -the failures in the bugs below. - -Note: this issue only affects the REALTIME encoding path. - -Bug: b/329088759, b/329674887, b/329179808 - -Change-Id: Icd65dbc5317120304d803f648d4bd9405710db6f -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/553293 -Reviewed-by: Michal Klocek ---- - .../source/libvpx/vp9/encoder/vp9_bitstream.c | 14 +++++++++++--- - 1 file changed, 11 insertions(+), 3 deletions(-) - -diff --git a/chromium/third_party/libvpx/source/libvpx/vp9/encoder/vp9_bitstream.c b/chromium/third_party/libvpx/source/libvpx/vp9/encoder/vp9_bitstream.c -index ca56d14aa1e..88a031e5fc1 100644 ---- src/3rdparty/chromium/third_party/libvpx/source/libvpx/vp9/encoder/vp9_bitstream.c -+++ src/3rdparty/chromium/third_party/libvpx/source/libvpx/vp9/encoder/vp9_bitstream.c -@@ -962,6 +962,14 @@ void vp9_bitstream_encode_tiles_buffer_dealloc(VP9_COMP *const cpi) { - } - } - -+static int encode_tiles_buffer_alloc_size(VP9_COMP *const cpi) { -+ VP9_COMMON *const cm = &cpi->common; -+ const int image_bps = -+ (8 + 2 * (8 >> (cm->subsampling_x + cm->subsampling_y))) * -+ (1 + (cm->bit_depth > 8)); -+ return cpi->oxcf.width * cpi->oxcf.height * image_bps / 8; -+} -+ - static void encode_tiles_buffer_alloc(VP9_COMP *const cpi) { - VP9_COMMON *const cm = &cpi->common; - int i; -@@ -972,7 +980,7 @@ static void encode_tiles_buffer_alloc(VP9_COMP *const cpi) { - memset(cpi->vp9_bitstream_worker_data, 0, worker_data_size); - for (i = 1; i < cpi->num_workers; ++i) { - cpi->vp9_bitstream_worker_data[i].dest_size = -- cpi->oxcf.width * cpi->oxcf.height; -+ encode_tiles_buffer_alloc_size(cpi); - CHECK_MEM_ERROR(&cm->error, cpi->vp9_bitstream_worker_data[i].dest, - vpx_malloc(cpi->vp9_bitstream_worker_data[i].dest_size)); - } -@@ -987,8 +995,8 @@ static size_t encode_tiles_mt(VP9_COMP *cpi, uint8_t *data_ptr) { - int tile_col = 0; - - if (!cpi->vp9_bitstream_worker_data || -- cpi->vp9_bitstream_worker_data[1].dest_size > -- (cpi->oxcf.width * cpi->oxcf.height)) { -+ cpi->vp9_bitstream_worker_data[1].dest_size != -+ encode_tiles_buffer_alloc_size(cpi)) { - vp9_bitstream_encode_tiles_buffer_dealloc(cpi); - encode_tiles_buffer_alloc(cpi); - } -From 4f90911c049d0278e900b94947fd0055b26d646e Mon Sep 17 00:00:00 2001 -From: Marco Paniconi -Date: Sat, 16 Mar 2024 10:39:28 -0700 -Subject: [PATCH] [Backport] Security bug 329674887 (2/2) - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/webm/libvpx/+/5375794:vp9: fix to integer overflow test - -failure for the 16k test: issue introduced -in: c29e637283 - -Bug: b/329088759, b/329674887, b/329179808 - -Change-Id: I88e8a36b7f13223997c3006c84aec9cfa48c0bcf -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/553294 -Reviewed-by: Michal Klocek ---- - .../libvpx/source/libvpx/vp9/encoder/vp9_bitstream.c | 4 +++- - 1 file changed, 3 insertions(+), 1 deletion(-) - -diff --git a/chromium/third_party/libvpx/source/libvpx/vp9/encoder/vp9_bitstream.c b/chromium/third_party/libvpx/source/libvpx/vp9/encoder/vp9_bitstream.c -index 88a031e5fc1..d3c029da4ba 100644 ---- src/3rdparty/chromium/third_party/libvpx/source/libvpx/vp9/encoder/vp9_bitstream.c -+++ src/3rdparty/chromium/third_party/libvpx/source/libvpx/vp9/encoder/vp9_bitstream.c -@@ -967,7 +967,9 @@ static int encode_tiles_buffer_alloc_size(VP9_COMP *const cpi) { - const int image_bps = - (8 + 2 * (8 >> (cm->subsampling_x + cm->subsampling_y))) * - (1 + (cm->bit_depth > 8)); -- return cpi->oxcf.width * cpi->oxcf.height * image_bps / 8; -+ const int64_t size = -+ (int64_t)cpi->oxcf.width * cpi->oxcf.height * image_bps / 8; -+ return (int)size; - } - - static void encode_tiles_buffer_alloc(VP9_COMP *const cpi) { -From 5af5e96fba0c40d3ddef2720de9117b6a4d6c267 Mon Sep 17 00:00:00 2001 -From: Peng Huang -Date: Wed, 20 Mar 2024 16:22:16 +0000 -Subject: [PATCH] [Backport] Security bug 327183408 - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5382202: -Fix PaintImage deserialization arbitrary-read issue - -(cherry picked from commit 47e8386c97ac7a84a96866fbd35422b99a01de5a) - -Bug: 327183408 -Change-Id: I09927fbae60b666aaa370e3aba01607cdb977a25 -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5370455 -Reviewed-by: Sunny Sachanandani -Commit-Queue: Peng Huang -Cr-Original-Commit-Position: refs/heads/main@{#1272930} -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5382202 -Auto-Submit: Peng Huang -Commit-Queue: Sunny Sachanandani -Cr-Commit-Position: refs/branch-heads/6261@{#1106} -Cr-Branched-From: 9755d9d81e4a8cb5b4f76b23b761457479dbb06b-refs/heads/main@{#1250580} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/553295 -Reviewed-by: Michal Klocek ---- - chromium/cc/paint/paint_op_reader.cc | 5 +++-- - 1 file changed, 3 insertions(+), 2 deletions(-) - -diff --git a/chromium/cc/paint/paint_op_reader.cc b/chromium/cc/paint/paint_op_reader.cc -index 935dbb05a50..6d920c33562 100644 ---- src/3rdparty/chromium/cc/paint/paint_op_reader.cc -+++ src/3rdparty/chromium/cc/paint/paint_op_reader.cc -@@ -1532,9 +1532,10 @@ inline void PaintOpReader::DidRead(size_t bytes_read) { - // All data are aligned with PaintOpWriter::kDefaultAlignment at least. - size_t aligned_bytes = - base::bits::AlignUp(bytes_read, PaintOpWriter::kDefaultAlignment); -- memory_ += aligned_bytes; - DCHECK_LE(aligned_bytes, remaining_bytes_); -- remaining_bytes_ -= aligned_bytes; -+ bytes_read = std::min(aligned_bytes, remaining_bytes_); -+ memory_ += bytes_read; -+ remaining_bytes_ -= bytes_read; - } - - } // namespace cc -From 0a17b9024c84404e4693718bbbd056517a2874a3 Mon Sep 17 00:00:00 2001 -From: Darius Mercadier -Date: Fri, 22 Mar 2024 17:55:04 +0100 -Subject: [PATCH] [Backport] CVE-2024-3159: Out of bounds memory access in V8 - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/v8/v8/+/5401859: -Merged: [runtime] Recreate enum cache on map update if any previous map had one - -If any previous map in the transition tree had an enum cache, then we -recreate one when updating the map. - -Bug: 330760873 -(cherry picked from commit 807cf7d0b7d96212c98ed2119e07f9b2c6a23f61) - -Change-Id: Ia9ea4cf17fef60166a0c037318eb539866aac37a -Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5401859 -Reviewed-by: Igor Sheludko -Commit-Queue: Igor Sheludko -Auto-Submit: Darius Mercadier -Cr-Commit-Position: refs/branch-heads/12.2@{#52} -Cr-Branched-From: 6eb5a9616aa6f8c705217aeb7c7ab8c037a2f676-refs/heads/12.2.281@{#1} -Cr-Branched-From: 44cf56d850167c6988522f8981730462abc04bcc-refs/heads/main@{#91934} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/553296 -Reviewed-by: Michal Klocek ---- - chromium/v8/src/objects/map-updater.cc | 13 ++++++++++--- - 1 file changed, 10 insertions(+), 3 deletions(-) - -diff --git a/chromium/v8/src/objects/map-updater.cc b/chromium/v8/src/objects/map-updater.cc -index 613a4921637..1d649373274 100644 ---- src/3rdparty/chromium/v8/src/objects/map-updater.cc -+++ src/3rdparty/chromium/v8/src/objects/map-updater.cc -@@ -1038,14 +1038,21 @@ MapUpdater::State MapUpdater::ConstructNewMap() { - Handle new_map = - Map::AddMissingTransitions(isolate_, split_map, new_descriptors); - -+ bool had_any_enum_cache = -+ split_map->instance_descriptors(isolate_) -+ ->enum_cache() -+ ->keys() -+ ->length() > 0 || -+ old_descriptors_->enum_cache()->keys()->length() > 0; -+ - // Deprecated part of the transition tree is no longer reachable, so replace - // current instance descriptors in the "survived" part of the tree with - // the new descriptors to maintain descriptors sharing invariant. - split_map->ReplaceDescriptors(isolate_, *new_descriptors); - -- // If the old descriptors had an enum cache, make sure the new ones do too. -- if (old_descriptors_->enum_cache()->keys()->length() > 0 && -- new_map->NumberOfEnumerableProperties() > 0) { -+ // If the old descriptors had an enum cache (or if {split_map}'s descriptors -+ // had one), make sure the new ones do too. -+ if (had_any_enum_cache && new_map->NumberOfEnumerableProperties() > 0) { - FastKeyAccumulator::InitializeFastPropertyEnumCache( - isolate_, new_map, new_map->NumberOfEnumerableProperties()); - } -From e76cac29493b1cb4b055f8944ea1e4e1284a12e6 Mon Sep 17 00:00:00 2001 -From: Raphael Kubo Da Costa -Date: Thu, 21 Mar 2024 16:50:44 +0000 -Subject: [PATCH] [Backport] Security bug 326349405 - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5383440: -Reland "sensors WinRT: Call OnReadingChangedCallback() via PostTask()" - -This reverts commit 745ca2de005c052f58097ef9cb7aa2deff095cf4. - -Reason for revert: Reapproved by pgrace@ in the bug. - -Original change's description: -> Revert "sensors WinRT: Call OnReadingChangedCallback() via PostTask()" -> -> This reverts commit 7e93b6a926ab65cc7ff1293bdcf0099c6e6e4e4e. -> -> Reason for revert: Requested in the bug by pgrace@ -> -> Original change's description: -> > sensors WinRT: Call OnReadingChangedCallback() via PostTask() -> > -> > While here, also add checks to make sure each method is running on the -> > right sequence and make |minimum_report_interval_| guarded by |lock_| -> > since it is accessed by the main task runner just like |client_|. -> > -> > There is a significant amount of changes in the unit tests for two -> > reasons: -> > 1. We now use multiple task runners and create Reader objects in a COM -> > STA task runner to better simulate what happens in production. -> > 2. Doing so has uncovered bugs in the exist tests that had to be fixed. -> > Namely: -> > - One of the biggest offenders was the use of EXPECT_CALL() with -> > WillRepeatedly() for expecting calls to OnReadingUpdated(). Using -> > only WillRepeatedly() meant the control over the cardinality of the -> > expectations was not very strict, and sometimes callbacks were -> > simply not being run. -> > Now that TriggerFakeSensorReading() is asynchronous and we need to -> > use a base::RunLoop to ensure, we are also using WillOnce() a lot -> > more than WillRepeatedly() so that we set one expectation, call -> > TriggerFakeSensorReading() and consume it immediately. -> > - The *Thresholding tests were affected by the problem above, and -> > fixing them showed that several callbacks were not being invoked. -> > Many checks where values were increased by the exact threshold -> > amount were broken because the manipulated values are floats and -> > doubles, and the math operations on them in the -> > OnReadingChangedCallback() implementations caused the comparisons -> > with exact values to fail. In this case, it was simpler to just -> > remove those specific tests, as the "values bigger than the -> > threshold" case are already covered by other checks. -> > - Also as a consequence of the above, *Thresholding tests with -> > multi-axis values were also broken when they went from testing that -> > values did not pass the threshold checks to the first test that -> > verifies that an axis passes the threshold check. This caused all -> > previous |last_sent_*| variables to be stored in the Reader, and -> > other calls to threshold_helper(true) would fail. The fix here was -> > to reorder the calls so that each axis is tested entirely before -> > the next. -> > -> > (cherry picked from commit 2aafa000795519b5153125673f87c734f7b8ae9f) -> > -> > Bug: 326349405 -> > Change-Id: Ief67720e8c449af1ce4f450002103a20ca1830ee -> > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5340216 -> > Auto-Submit: Raphael Kubo Da Costa -> > Commit-Queue: Raphael Kubo Da Costa -> > Reviewed-by: Reilly Grant -> > Cr-Original-Commit-Position: refs/heads/main@{#1268797} -> > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5372846 -> > Reviewed-by: Colin Blundell -> > Cr-Commit-Position: refs/branch-heads/6261@{#1079} -> > Cr-Branched-From: 9755d9d81e4a8cb5b4f76b23b761457479dbb06b-refs/heads/main@{#1250580} -> -> Bug: 326349405 -> Change-Id: I49d61cf7bdf2a00004aa565a5439ad813b1c379e -> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5378404 -> Commit-Queue: Raphael Kubo Da Costa -> Bot-Commit: Rubber Stamper -> Cr-Commit-Position: refs/branch-heads/6261@{#1090} -> Cr-Branched-From: 9755d9d81e4a8cb5b4f76b23b761457479dbb06b-refs/heads/main@{#1250580} - -Bug: 326349405 -Change-Id: I3bcba8840a3a10cd4660ec287fa24623bcf87657 -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5383440 -Bot-Commit: Rubber Stamper -Commit-Queue: Raphael Kubo Da Costa -Cr-Commit-Position: refs/branch-heads/6261@{#1111} -Cr-Branched-From: 9755d9d81e4a8cb5b4f76b23b761457479dbb06b-refs/heads/main@{#1250580} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/553297 -Reviewed-by: Allan Sandfeld Jensen ---- - .../platform_sensor_reader_winrt.cc | 79 +- - .../platform_sensor_reader_winrt.h | 32 +- - .../platform_sensor_reader_winrt_unittests.cc | 787 ++++++++++-------- - .../generic_sensor/platform_sensor_win.cc | 3 + - 4 files changed, 549 insertions(+), 352 deletions(-) - -diff --git a/chromium/services/device/generic_sensor/platform_sensor_reader_winrt.cc b/chromium/services/device/generic_sensor/platform_sensor_reader_winrt.cc -index 6c778b7edf0c..673225e398a2 100644 ---- src/3rdparty/chromium/services/device/generic_sensor/platform_sensor_reader_winrt.cc -+++ src/3rdparty/chromium/services/device/generic_sensor/platform_sensor_reader_winrt.cc -@@ -8,6 +8,7 @@ - - #include "base/numerics/math_constants.h" - #include "base/time/time.h" -+#include "base/win/com_init_util.h" - #include "base/win/core_winrt_util.h" - #include "services/device/generic_sensor/generic_sensor_consts.h" - #include "services/device/public/mojom/sensor.mojom.h" -@@ -99,7 +100,11 @@ PlatformSensorReaderWinrtBase< - ISensorWinrtStatics, - ISensorWinrtClass, - ISensorReadingChangedHandler, -- ISensorReadingChangedEventArgs>::PlatformSensorReaderWinrtBase() { -+ ISensorReadingChangedEventArgs>::PlatformSensorReaderWinrtBase() -+ : com_sta_task_runner_(base::SingleThreadTaskRunner::GetCurrentDefault()) { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(com_sta_sequence_checker_); -+ DETACH_FROM_SEQUENCE(main_sequence_checker_); -+ - get_sensor_factory_callback_ = - base::BindRepeating([](ISensorWinrtStatics** sensor_factory) -> HRESULT { - return base::win::GetActivationFactory::SetClient(Client* client) { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(main_sequence_checker_); -+ - base::AutoLock autolock(lock_); - client_ = client; - } -@@ -136,6 +143,8 @@ HRESULT PlatformSensorReaderWinrtBase:: - ConvertSensorReadingTimeStamp(ComPtr sensor_reading, - base::TimeDelta* timestamp_delta) { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(com_sta_sequence_checker_); -+ - DateTime timestamp; - HRESULT hr = sensor_reading->get_Timestamp(×tamp); - if (FAILED(hr)) -@@ -157,6 +166,8 @@ bool PlatformSensorReaderWinrtBase< - ISensorWinrtClass, - ISensorReadingChangedHandler, - ISensorReadingChangedEventArgs>::Initialize() { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(com_sta_sequence_checker_); -+ - ComPtr sensor_statics; - - HRESULT hr = get_sensor_factory_callback_.Run(&sensor_statics); -@@ -180,10 +191,14 @@ bool PlatformSensorReaderWinrtBase< - return false; - } - -- minimum_report_interval_ = GetMinimumReportIntervalFromSensor(); -+ { -+ base::AutoLock autolock(lock_); -+ minimum_report_interval_ = GetMinimumReportIntervalFromSensor(); - -- if (minimum_report_interval_.is_zero()) -- DLOG(WARNING) << "Failed to get sensor minimum report interval"; -+ if (minimum_report_interval_.is_zero()) { -+ DLOG(WARNING) << "Failed to get sensor minimum report interval"; -+ } -+ } - - return true; - } -@@ -199,6 +214,8 @@ base::TimeDelta PlatformSensorReaderWinrtBase< - ISensorWinrtClass, - ISensorReadingChangedHandler, - ISensorReadingChangedEventArgs>::GetMinimumReportIntervalFromSensor() { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(com_sta_sequence_checker_); -+ - UINT32 minimum_report_interval_ms = 0; - HRESULT hr = sensor_->get_MinimumReportInterval(&minimum_report_interval_ms); - -@@ -225,6 +242,9 @@ base::TimeDelta PlatformSensorReaderWinrtBase< - ISensorWinrtClass, - ISensorReadingChangedHandler, - ISensorReadingChangedEventArgs>::GetMinimalReportingInterval() const { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(main_sequence_checker_); -+ -+ base::AutoLock autolock(lock_); - return minimum_report_interval_; - } - -@@ -239,6 +259,8 @@ bool PlatformSensorReaderWinrtBase:: - StartSensor(const PlatformSensorConfiguration& configuration) { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(main_sequence_checker_); -+ - base::AutoLock autolock(lock_); - - if (!reading_callback_token_) { -@@ -256,7 +278,39 @@ bool PlatformSensorReaderWinrtBase( -- this, &PlatformSensorReaderWinrtBase::OnReadingChangedCallback); -+ [weak_ptr(weak_ptr_factory_.GetWeakPtr()), -+ com_sta_task_runner(com_sta_task_runner_)]( -+ ISensorWinrtClass* sender, ISensorReadingChangedEventArgs* args) { -+ // We cannot invoke OnReadingChangedCallback() directly because this -+ // callback is run on a COM MTA thread spawned by Windows (on tests, -+ // we mimic the behavior by using base::ThreadPool, as the task -+ // scheduler threads live in the MTA). -+ // -+ // This callback is invoked on an MTA thread because the -+ // ISensorReadingChangedHandler declarations explicitly inherit from -+ // Microsoft::WRL::FtmBase, which makes them agile, free-threaded -+ // objects. -+ // -+ // We could CHECK() this behavior here, but ::CoGetApartmentType() -+ // depends on ole32.dll and base::win::GetComApartmentTypeForThread() -+ // returns NONE in the non-test code path even though -+ // ::GoGetApartmentType() returns MTA, so the best we can do is just -+ // double-check that this is not running on an STA. -+ DCHECK_NE(base::win::GetComApartmentTypeForThread(), -+ base::win::ComApartmentType::STA); -+ com_sta_task_runner->PostTask( -+ FROM_HERE, -+ base::BindOnce( -+ // TODO(crbug.com/326349405): base::IgnoreResult is being used -+ // temporarily to reduce the amount of changes required for -+ // this bug. OnReadingChangedCallback() must be changed to -+ // have a void return type. -+ base::IgnoreResult( -+ &PlatformSensorReaderWinrtBase::OnReadingChangedCallback), -+ weak_ptr, ComPtr(sender), -+ ComPtr(args))); -+ return S_OK; -+ }); - - EventRegistrationToken event_token; - hr = sensor_->add_ReadingChanged(reading_changed_handler.Get(), -@@ -285,6 +339,9 @@ void PlatformSensorReaderWinrtBase< - ISensorWinrtClass, - ISensorReadingChangedHandler, - ISensorReadingChangedEventArgs>::StopSensor() { -+ // This function is called in the main task runner by PlatformSensorWin as -+ // well as in the com_sta_task_runner_ by the destructor. -+ - base::AutoLock autolock(lock_); - - if (reading_callback_token_) { -@@ -316,6 +373,8 @@ PlatformSensorReaderWinrtLightSensor::PlatformSensorReaderWinrtLightSensor() = - HRESULT PlatformSensorReaderWinrtLightSensor::OnReadingChangedCallback( - ILightSensor* light_sensor, - ILightSensorReadingChangedEventArgs* reading_changed_args) { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(com_sta_sequence_checker_); -+ - ComPtr light_sensor_reading; - HRESULT hr = reading_changed_args->get_Reading(&light_sensor_reading); - if (FAILED(hr)) { -@@ -379,6 +438,8 @@ PlatformSensorReaderWinrtAccelerometer:: - HRESULT PlatformSensorReaderWinrtAccelerometer::OnReadingChangedCallback( - IAccelerometer* accelerometer, - IAccelerometerReadingChangedEventArgs* reading_changed_args) { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(com_sta_sequence_checker_); -+ - ComPtr accelerometer_reading; - HRESULT hr = reading_changed_args->get_Reading(&accelerometer_reading); - if (FAILED(hr)) { -@@ -464,6 +525,8 @@ PlatformSensorReaderWinrtGyrometer::PlatformSensorReaderWinrtGyrometer() = - HRESULT PlatformSensorReaderWinrtGyrometer::OnReadingChangedCallback( - IGyrometer* gyrometer, - IGyrometerReadingChangedEventArgs* reading_changed_args) { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(com_sta_sequence_checker_); -+ - ComPtr gyrometer_reading; - HRESULT hr = reading_changed_args->get_Reading(&gyrometer_reading); - if (FAILED(hr)) { -@@ -548,6 +611,8 @@ PlatformSensorReaderWinrtMagnetometer::PlatformSensorReaderWinrtMagnetometer() = - HRESULT PlatformSensorReaderWinrtMagnetometer::OnReadingChangedCallback( - IMagnetometer* magnetometer, - IMagnetometerReadingChangedEventArgs* reading_changed_args) { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(com_sta_sequence_checker_); -+ - ComPtr magnetometer_reading; - HRESULT hr = reading_changed_args->get_Reading(&magnetometer_reading); - if (FAILED(hr)) { -@@ -631,6 +696,8 @@ HRESULT - PlatformSensorReaderWinrtAbsOrientationEulerAngles::OnReadingChangedCallback( - IInclinometer* inclinometer, - IInclinometerReadingChangedEventArgs* reading_changed_args) { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(com_sta_sequence_checker_); -+ - ComPtr inclinometer_reading; - HRESULT hr = reading_changed_args->get_Reading(&inclinometer_reading); - if (FAILED(hr)) { -@@ -717,6 +784,8 @@ HRESULT - PlatformSensorReaderWinrtAbsOrientationQuaternion::OnReadingChangedCallback( - IOrientationSensor* orientation_sensor, - IOrientationSensorReadingChangedEventArgs* reading_changed_args) { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(com_sta_sequence_checker_); -+ - ComPtr orientation_sensor_reading; - HRESULT hr = reading_changed_args->get_Reading(&orientation_sensor_reading); - if (FAILED(hr)) { -diff --git a/chromium/services/device/generic_sensor/platform_sensor_reader_winrt.h b/chromium/services/device/generic_sensor/platform_sensor_reader_winrt.h -index 66c40adc59e8..e4521a7816fa 100644 ---- src/3rdparty/chromium/services/device/generic_sensor/platform_sensor_reader_winrt.h -+++ src/3rdparty/chromium/services/device/generic_sensor/platform_sensor_reader_winrt.h -@@ -14,7 +14,10 @@ - - #include "base/functional/callback.h" - #include "base/memory/raw_ptr.h" -+#include "base/memory/weak_ptr.h" -+#include "base/sequence_checker.h" - #include "base/synchronization/lock.h" -+#include "base/task/single_thread_task_runner.h" - #include "base/thread_annotations.h" - #include "base/time/time.h" - #include "services/device/generic_sensor/platform_sensor_reader_win_base.h" -@@ -77,7 +80,10 @@ class PlatformSensorReaderWinrtBase : public PlatformSensorReaderWinBase { - - protected: - PlatformSensorReaderWinrtBase(); -- virtual ~PlatformSensorReaderWinrtBase() { StopSensor(); } -+ virtual ~PlatformSensorReaderWinrtBase() { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(com_sta_sequence_checker_); -+ StopSensor(); -+ } - - // Derived classes should implement this function to handle sensor specific - // parsing of the sensor reading. -@@ -93,11 +99,15 @@ class PlatformSensorReaderWinrtBase : public PlatformSensorReaderWinBase { - Microsoft::WRL::ComPtr sensor_reading, - base::TimeDelta* timestamp_delta); - -- // Following class member is protected by lock since SetClient, -- // StartSensor, and StopSensor can all be called from different -- // threads by PlatformSensorWin. -- base::Lock lock_; -- // Null if there is no client to notify, non-null otherwise. -+ SEQUENCE_CHECKER(com_sta_sequence_checker_); -+ SEQUENCE_CHECKER(main_sequence_checker_); -+ -+ mutable base::Lock lock_; -+ -+ // Null if there is no client to notify, non-null otherwise. Protected by -+ // |lock_| because SetClient() and StartSensor() are called from the main -+ // task runner rather than the thread where this object is created, and -+ // StopSensor() may be called from the main task runner too. - raw_ptr client_ GUARDED_BY(lock_); - - // Always report the first sample received after starting the sensor. -@@ -106,13 +116,21 @@ class PlatformSensorReaderWinrtBase : public PlatformSensorReaderWinBase { - private: - base::TimeDelta GetMinimumReportIntervalFromSensor(); - -+ // Task runner where this object was created. -+ scoped_refptr com_sta_task_runner_; -+ - GetSensorFactoryFunctor get_sensor_factory_callback_; - - // absl::nullopt if the sensor has not been started, non-empty otherwise. - absl::optional reading_callback_token_; - -- base::TimeDelta minimum_report_interval_; -+ // Protected by |lock_| because GetMinimalReportingInterval() is called from -+ // the main task runner. -+ base::TimeDelta minimum_report_interval_ GUARDED_BY(lock_); -+ - Microsoft::WRL::ComPtr sensor_; -+ -+ base::WeakPtrFactory weak_ptr_factory_{this}; - }; - - class PlatformSensorReaderWinrtLightSensor final -diff --git a/chromium/services/device/generic_sensor/platform_sensor_reader_winrt_unittests.cc b/chromium/services/device/generic_sensor/platform_sensor_reader_winrt_unittests.cc -index 2283de90c75d..f6add828b496 100644 ---- src/3rdparty/chromium/services/device/generic_sensor/platform_sensor_reader_winrt_unittests.cc -+++ src/3rdparty/chromium/services/device/generic_sensor/platform_sensor_reader_winrt_unittests.cc -@@ -6,8 +6,13 @@ - - #include - -+#include "base/notreached.h" - #include "base/numerics/math_constants.h" -+#include "base/run_loop.h" -+#include "base/task/task_traits.h" -+#include "base/task/thread_pool.h" - #include "base/test/bind.h" -+#include "base/test/gmock_callback_support.h" - #include "base/test/task_environment.h" - #include "base/win/core_winrt_util.h" - #include "base/win/scoped_com_initializer.h" -@@ -428,15 +433,26 @@ class FakeSensorWinrt - return remove_reading_changed_return_code_; - } - -- // Makes any clients registered via add_ReadingChanged() to trigger with -- // the given sensor reading. -+ // Invokes the handler added via add_ReadingChanged() with the reading -+ // described by |reading|. -+ // -+ // The invocation is asynchronous to better simulate real behavior, where -+ // Windows delivers the reading notifications in a separate MTA thread. - void TriggerFakeSensorReading( - Microsoft::WRL::ComPtr reading) { -- EXPECT_TRUE(handler_); - Microsoft::WRL::ComPtr reading_event_args = - Microsoft::WRL::Make>(reading); -- EXPECT_HRESULT_SUCCEEDED(handler_->Invoke(this, reading_event_args.Get())); -+ base::ThreadPool::PostTask( -+ FROM_HERE, {base::MayBlock()}, -+ base::BindLambdaForTesting( -+ // Copy |handler_| and |reading_event_args| to ensure they do not -+ // lose their values when TriggerFakeSensorReading() exits. -+ [this, handler = handler_, reading_event_args]() { -+ ASSERT_TRUE(handler); -+ EXPECT_HRESULT_SUCCEEDED( -+ handler->Invoke(this, reading_event_args.Get())); -+ })); - } - - // Returns true if any clients are registered for readings via -@@ -547,7 +563,47 @@ class FakeSensorFactoryWinrt - }; - - class PlatformSensorReaderTestWinrt : public testing::Test { -- private: -+ public: -+ void SetUp() override { -+ // Ensure each test starts with a fresh task runner. -+ com_sta_task_runner_ = -+ base::ThreadPool::CreateCOMSTATaskRunner({base::MayBlock()}); -+ } -+ -+ // Synchronously creates a new PlatformSensorReaderWinrtBase-derived class on -+ // |com_sta_task_runner_| and returns it. -+ // -+ // This better simulates real behavior, as PlatformSensorProviderWinrt -+ // creates readers on a COM STA task runner. -+ template -+ auto CreateAndInitializeSensor( -+ const Microsoft::WRL::ComPtr< -+ FakeSensorFactoryWinrt>& -+ fake_sensor_factory) { -+ std::unique_ptr reader( -+ nullptr, base::OnTaskRunnerDeleter(com_sta_task_runner_)); -+ -+ base::RunLoop run_loop; -+ com_sta_task_runner_->PostTaskAndReply( -+ FROM_HERE, base::BindLambdaForTesting([&]() { -+ reader.reset(new SensorReader); -+ reader->InitForTesting(base::BindLambdaForTesting( -+ [&](ISensorStatics** sensor_factory) -> HRESULT { -+ return fake_sensor_factory.CopyTo(sensor_factory); -+ })); -+ ASSERT_TRUE(reader->Initialize()); -+ }), -+ run_loop.QuitClosure()); -+ run_loop.Run(); -+ -+ return reader; -+ } -+ -+ protected: -+ scoped_refptr com_sta_task_runner_; -+ - base::test::TaskEnvironment task_environment_; - base::win::ScopedCOMInitializer scoped_com_initializer_; - }; -@@ -602,11 +658,9 @@ TEST_F(PlatformSensorReaderTestWinrt, SensorMinimumReportInterval) { - ABI::Windows::Devices::Sensors::LightSensorReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::ILightSensorStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - EXPECT_EQ(sensor->GetMinimalReportingInterval().InMilliseconds(), - kExpectedMinimumReportInterval); -@@ -623,20 +677,42 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedSensorMinimumReportInterval) { - ABI::Windows::Devices::Sensors::ILightSensorReadingChangedEventArgs, - ABI::Windows::Devices::Sensors::LightSensorReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; -- -- auto sensor = std::make_unique(); - fake_sensor->SetGetMinimumReportIntervalReturnCode(E_FAIL); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::ILightSensorStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ -+ auto sensor = CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - EXPECT_EQ(sensor->GetMinimalReportingInterval().InMilliseconds(), 0); - } - --// Tests that PlatformSensorReaderWinrtBase converts the timestamp correctly --TEST_F(PlatformSensorReaderTestWinrt, SensorTimestampConversion) { -- static constexpr double expectedTimestampDeltaSecs = 19.0; -+TEST_F(PlatformSensorReaderTestWinrt, ReadingChangedCallbackAndPostTask) { -+ // Instead of using PlatformSensorReaderWinrtLightSensor, declare a custom -+ // implementation that does less and whose sole purpose is to assert that its -+ // OnReadingChangedCallback() implementation is never called. -+ struct CustomLightSensor -+ : public PlatformSensorReaderWinrtBase< -+ RuntimeClass_Windows_Devices_Sensors_LightSensor, -+ ABI::Windows::Devices::Sensors::ILightSensorStatics, -+ ABI::Windows::Devices::Sensors::ILightSensor, -+ Microsoft::WRL::Implements< -+ Microsoft::WRL::RuntimeClassFlags, -+ ABI::Windows::Foundation::ITypedEventHandler< -+ ABI::Windows::Devices::Sensors::LightSensor*, -+ ABI::Windows::Devices::Sensors:: -+ LightSensorReadingChangedEventArgs*>, -+ Microsoft::WRL::FtmBase>, -+ ABI::Windows::Devices::Sensors:: -+ ILightSensorReadingChangedEventArgs> { -+ ~CustomLightSensor() override = default; -+ -+ HRESULT OnReadingChangedCallback( -+ ABI::Windows::Devices::Sensors::ILightSensor*, -+ ABI::Windows::Devices::Sensors::ILightSensorReadingChangedEventArgs*) -+ override { -+ NOTREACHED_NORETURN() << "This function should not have been reached"; -+ } -+ }; - - auto fake_sensor_factory = Microsoft::WRL::Make>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -+ // Instead of using CreateAndInitializeSensor(), for simplicity and for -+ // better control over |light_sensor|'s lifetime we invert things and create -+ // the object in the main task runner and invoke StartSensor() from another -+ // one. The effect on the Reader is the same -- the calls are still made from -+ // different task runners. -+ auto light_sensor = std::make_unique(); -+ light_sensor->InitForTesting(base::BindLambdaForTesting( - [&](ABI::Windows::Devices::Sensors::ILightSensorStatics** sensor_factory) - -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ ASSERT_TRUE(light_sensor->Initialize()); -+ -+ base::RunLoop run_loop; -+ base::ThreadPool::PostTaskAndReply( -+ FROM_HERE, base::BindLambdaForTesting([&]() { -+ ASSERT_TRUE(light_sensor->StartSensor( -+ PlatformSensorConfiguration(kExpectedReportFrequencySet))); -+ }), -+ run_loop.QuitClosure()); -+ run_loop.Run(); -+ -+ // The idea here is to rely on the fact that TriggerFakeSensorReading() is -+ // asynchronous: we call it while it has a valid handler, it schedules a -+ // task, we destroy the handler object synchronoustly and then it Invoke()s -+ // the callback, which should never reach -+ // CustomLightSensor::OnReadingChangedCallback(). -+ Microsoft::WRL::ComPtr -+ reading = Microsoft::WRL::Make( -+ ABI::Windows::Foundation::DateTime{}, 0.0f); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ light_sensor.reset(); -+ task_environment_.RunUntilIdle(); -+} - -- auto mock_client = std::make_unique>(); -+// Tests that PlatformSensorReaderWinrtBase converts the timestamp correctly -+TEST_F(PlatformSensorReaderTestWinrt, SensorTimestampConversion) { -+ static constexpr double expectedTimestampDeltaSecs = 19.0; - -- double lastReportedTimestamp = 0.0; -- EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -- .WillRepeatedly(testing::Invoke([&](const SensorReading& reading) { -- lastReportedTimestamp = reading.als.timestamp; -- EXPECT_EQ(reading.als.value, 0.0f); -- })); -+ auto fake_sensor_factory = Microsoft::WRL::Make>(); -+ auto fake_sensor = fake_sensor_factory->fake_sensor_; -+ -+ auto sensor = CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - -+ auto mock_client = std::make_unique>(); - sensor->SetClient(mock_client.get()); - - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); -@@ -672,18 +784,35 @@ TEST_F(PlatformSensorReaderTestWinrt, SensorTimestampConversion) { - Microsoft::WRL::ComPtr - reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, 0.0f); -- fake_sensor->TriggerFakeSensorReading(reading); -- EXPECT_EQ(lastReportedTimestamp, 0); -+ { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(testing::Invoke([&](const SensorReading& reading) { -+ EXPECT_EQ(reading.als.timestamp, 0.0); -+ EXPECT_EQ(reading.als.value, 0.0f); -+ run_loop.Quit(); -+ })); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } - -+ // Verify the reported time stamp has ticked forward -+ // expectedTimestampDeltaSecs - auto second_timestamp = - base::Seconds(expectedTimestampDeltaSecs).ToWinrtDateTime(); - reading = - Microsoft::WRL::Make(second_timestamp, 0.0f); -- fake_sensor->TriggerFakeSensorReading(reading); -- -- // Verify the reported time stamp has ticked forward -- // expectedTimestampDeltaSecs -- EXPECT_EQ(lastReportedTimestamp, expectedTimestampDeltaSecs); -+ { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(testing::Invoke([&](const SensorReading& reading) { -+ EXPECT_EQ(reading.als.timestamp, expectedTimestampDeltaSecs); -+ EXPECT_EQ(reading.als.value, 0.0f); -+ run_loop.Quit(); -+ })); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } - } - - // Tests that PlatformSensorReaderWinrtBase starts and stops the -@@ -698,11 +827,9 @@ TEST_F(PlatformSensorReaderTestWinrt, StartStopSensorCallbacks) { - ABI::Windows::Devices::Sensors::LightSensorReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::ILightSensorStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); - EXPECT_TRUE(sensor->StartSensor(sensor_config)); -@@ -732,17 +859,19 @@ TEST_F(PlatformSensorReaderTestWinrt, StartWithoutStopSensorCallbacks) { - ABI::Windows::Devices::Sensors::LightSensorReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::ILightSensorStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); - EXPECT_TRUE(sensor->StartSensor(sensor_config)); - EXPECT_TRUE(fake_sensor->IsSensorStarted()); - -+ // *sensor is deleted in |com_sta_task_runner_|, so we need to wait for it to -+ // happen asynchronously. - sensor.reset(); -+ task_environment_.RunUntilIdle(); -+ - EXPECT_FALSE(fake_sensor->IsSensorStarted()); - } - -@@ -758,11 +887,9 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedSensorStart) { - ABI::Windows::Devices::Sensors::LightSensorReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::ILightSensorStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - fake_sensor->SetPutReportIntervalReturnCode(E_FAIL); - -@@ -787,11 +914,9 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedSensorStop) { - ABI::Windows::Devices::Sensors::LightSensorReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::ILightSensorStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); - EXPECT_TRUE(sensor->StartSensor(sensor_config)); -@@ -813,11 +938,9 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedLightSensorSampleParse) { - ABI::Windows::Devices::Sensors::LightSensorReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::ILightSensorStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); - -@@ -832,12 +955,17 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedLightSensorSampleParse) { - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, 0.0f); - -+ // We cannot use a base::RunLoop in the checks below because we are expecting -+ // that MockClient::OnReadingUpdate() does _not_ get called. -+ - reading->SetGetTimestampReturnCode(E_FAIL); - fake_sensor->TriggerFakeSensorReading(reading); - - reading->SetGetTimestampReturnCode(S_OK); - reading->SetGetIlluminanceInLuxReturnCode(E_FAIL); - fake_sensor->TriggerFakeSensorReading(reading); -+ -+ task_environment_.RunUntilIdle(); - } - - // Tests that PlatformSensorReaderWinrtLightSensor notifies the client -@@ -854,19 +982,11 @@ TEST_F(PlatformSensorReaderTestWinrt, SensorClientNotification) { - ABI::Windows::Devices::Sensors::LightSensorReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::ILightSensorStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); -- -- EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -- .WillOnce(testing::Invoke([&](const SensorReading& reading) { -- EXPECT_EQ(expected_lux, reading.als.value); -- })); -- - sensor->SetClient(mock_client.get()); - - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); -@@ -874,8 +994,16 @@ TEST_F(PlatformSensorReaderTestWinrt, SensorClientNotification) { - - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, expected_lux); -- fake_sensor->TriggerFakeSensorReading(reading); -- -+ { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(testing::Invoke([&](const SensorReading& reading) { -+ EXPECT_EQ(expected_lux, reading.als.value); -+ run_loop.Quit(); -+ })); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } - sensor->StopSensor(); - } - -@@ -896,30 +1024,31 @@ TEST_F(PlatformSensorReaderTestWinrt, CheckAccelerometerReadingConversion) { - Microsoft::WRL::Make()); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IAccelerometerStatics** -- sensor_factory) -> HRESULT { -- return fake_sensor_factory.CopyTo(sensor_factory); -- })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = -+ CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); -- EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -- .WillOnce(testing::Invoke([&](const SensorReading& reading) { -- EXPECT_EQ(-expected_x * base::kMeanGravityDouble, reading.accel.x); -- EXPECT_EQ(-expected_y * base::kMeanGravityDouble, reading.accel.y); -- EXPECT_EQ(-expected_z * base::kMeanGravityDouble, reading.accel.z); -- })); -- - sensor->SetClient(mock_client.get()); - - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); -- - EXPECT_TRUE(sensor->StartSensor(sensor_config)); -+ - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, expected_x, expected_y, expected_z); -- fake_sensor->TriggerFakeSensorReading(reading); -+ { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(testing::Invoke([&](const SensorReading& reading) { -+ EXPECT_EQ(-expected_x * base::kMeanGravityDouble, reading.accel.x); -+ EXPECT_EQ(-expected_y * base::kMeanGravityDouble, reading.accel.y); -+ EXPECT_EQ(-expected_z * base::kMeanGravityDouble, reading.accel.z); -+ run_loop.Quit(); -+ })); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } - - sensor->StopSensor(); - } -@@ -937,13 +1066,10 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedAccelerometerSampleParse) { - Microsoft::WRL::Make()); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IAccelerometerStatics** -- sensor_factory) -> HRESULT { -- return fake_sensor_factory.CopyTo(sensor_factory); -- })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = -+ CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); - sensor->SetClient(mock_client.get()); -@@ -954,6 +1080,9 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedAccelerometerSampleParse) { - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, 0, 0, 0); - -+ // We cannot use a base::RunLoop in the checks below because we are expecting -+ // that MockClient::OnReadingUpdate() does _not_ get called. -+ - reading->SetGetTimestampReturnCode(E_FAIL); - fake_sensor->TriggerFakeSensorReading(reading); - -@@ -968,6 +1097,8 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedAccelerometerSampleParse) { - reading->SetGetYReturnCode(S_OK); - reading->SetGetZReturnCode(E_FAIL); - fake_sensor->TriggerFakeSensorReading(reading); -+ -+ task_environment_.RunUntilIdle(); - } - - // Tests if PlatformSensorReaderWinrtGyrometer correctly converts sensor -@@ -986,27 +1117,30 @@ TEST_F(PlatformSensorReaderTestWinrt, CheckGyrometerReadingConversion) { - ABI::Windows::Devices::Sensors::GyrometerReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IGyrometerStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); -- EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -- .WillOnce(testing::Invoke([&](const SensorReading& reading) { -- EXPECT_EQ(gfx::DegToRad(expected_x), reading.gyro.x); -- EXPECT_EQ(gfx::DegToRad(expected_y), reading.gyro.y); -- EXPECT_EQ(gfx::DegToRad(expected_z), reading.gyro.z); -- })); -- - sensor->SetClient(mock_client.get()); -+ - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); - EXPECT_TRUE(sensor->StartSensor(sensor_config)); - - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, expected_x, expected_y, expected_z); -- fake_sensor->TriggerFakeSensorReading(reading); -+ { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(testing::Invoke([&](const SensorReading& reading) { -+ EXPECT_EQ(gfx::DegToRad(expected_x), reading.gyro.x); -+ EXPECT_EQ(gfx::DegToRad(expected_y), reading.gyro.y); -+ EXPECT_EQ(gfx::DegToRad(expected_z), reading.gyro.z); -+ run_loop.Quit(); -+ })); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } - - sensor->StopSensor(); - } -@@ -1023,11 +1157,9 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedGyrometerSampleParse) { - ABI::Windows::Devices::Sensors::GyrometerReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IGyrometerStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); - sensor->SetClient(mock_client.get()); -@@ -1038,6 +1170,9 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedGyrometerSampleParse) { - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, 0, 0, 0); - -+ // We cannot use a base::RunLoop in the checks below because we are expecting -+ // that MockClient::OnReadingUpdate() does _not_ get called. -+ - reading->SetGetTimestampReturnCode(E_FAIL); - fake_sensor->TriggerFakeSensorReading(reading); - -@@ -1052,6 +1187,8 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedGyrometerSampleParse) { - reading->SetGetYReturnCode(S_OK); - reading->SetGetZReturnCode(E_FAIL); - fake_sensor->TriggerFakeSensorReading(reading); -+ -+ task_environment_.RunUntilIdle(); - } - - // Tests if PlatformSensorReaderWinrtMagnetometer correctly converts sensor -@@ -1070,27 +1207,31 @@ TEST_F(PlatformSensorReaderTestWinrt, CheckMagnetometerReadingConversion) { - ABI::Windows::Devices::Sensors::MagnetometerReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IMagnetometerStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = -+ CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); -- EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -- .WillOnce(testing::Invoke([&](const SensorReading& reading) { -- EXPECT_EQ(expected_x, reading.magn.x); -- EXPECT_EQ(expected_y, reading.magn.y); -- EXPECT_EQ(expected_z, reading.magn.z); -- })); -- - sensor->SetClient(mock_client.get()); -+ - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); - EXPECT_TRUE(sensor->StartSensor(sensor_config)); - - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, expected_x, expected_y, expected_z); -- fake_sensor->TriggerFakeSensorReading(reading); -+ { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(testing::Invoke([&](const SensorReading& reading) { -+ EXPECT_EQ(expected_x, reading.magn.x); -+ EXPECT_EQ(expected_y, reading.magn.y); -+ EXPECT_EQ(expected_z, reading.magn.z); -+ run_loop.Quit(); -+ })); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } - - sensor->StopSensor(); - } -@@ -1107,11 +1248,10 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedMagnetometerSampleParse) { - ABI::Windows::Devices::Sensors::MagnetometerReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IMagnetometerStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = -+ CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); - sensor->SetClient(mock_client.get()); -@@ -1122,6 +1262,9 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedMagnetometerSampleParse) { - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, 0, 0, 0); - -+ // We cannot use a base::RunLoop in the checks below because we are expecting -+ // that MockClient::OnReadingUpdate() does _not_ get called. -+ - reading->SetGetTimestampReturnCode(E_FAIL); - fake_sensor->TriggerFakeSensorReading(reading); - -@@ -1136,6 +1279,8 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedMagnetometerSampleParse) { - reading->SetGetYReturnCode(S_OK); - reading->SetGetZReturnCode(E_FAIL); - fake_sensor->TriggerFakeSensorReading(reading); -+ -+ task_environment_.RunUntilIdle(); - } - - // Tests if PlatformSensorReaderWinrtAbsOrientationEulerAngles correctly -@@ -1154,28 +1299,30 @@ TEST_F(PlatformSensorReaderTestWinrt, CheckInclinometerReadingConversion) { - ABI::Windows::Devices::Sensors::InclinometerReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = -- std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IInclinometerStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor< -+ PlatformSensorReaderWinrtAbsOrientationEulerAngles>(fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); -- EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -- .WillOnce(testing::Invoke([&](const SensorReading& reading) { -- EXPECT_EQ(expected_x, reading.orientation_euler.x); -- EXPECT_EQ(expected_y, reading.orientation_euler.y); -- EXPECT_EQ(expected_z, reading.orientation_euler.z); -- })); -- - sensor->SetClient(mock_client.get()); -+ - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); - EXPECT_TRUE(sensor->StartSensor(sensor_config)); - - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, expected_x, expected_y, expected_z); -- fake_sensor->TriggerFakeSensorReading(reading); -+ { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(testing::Invoke([&](const SensorReading& reading) { -+ EXPECT_EQ(expected_x, reading.orientation_euler.x); -+ EXPECT_EQ(expected_y, reading.orientation_euler.y); -+ EXPECT_EQ(expected_z, reading.orientation_euler.z); -+ run_loop.Quit(); -+ })); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } - - sensor->StopSensor(); - } -@@ -1192,12 +1339,9 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedInclinometerSampleParse) { - ABI::Windows::Devices::Sensors::InclinometerReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = -- std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IInclinometerStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor< -+ PlatformSensorReaderWinrtAbsOrientationEulerAngles>(fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); - sensor->SetClient(mock_client.get()); -@@ -1208,6 +1352,9 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedInclinometerSampleParse) { - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, 0, 0, 0); - -+ // We cannot use a base::RunLoop in the checks below because we are expecting -+ // that MockClient::OnReadingUpdate() does _not_ get called. -+ - reading->SetGetTimestampReturnCode(E_FAIL); - fake_sensor->TriggerFakeSensorReading(reading); - -@@ -1222,6 +1369,8 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedInclinometerSampleParse) { - reading->SetGetYReturnCode(S_OK); - reading->SetGetZReturnCode(E_FAIL); - fake_sensor->TriggerFakeSensorReading(reading); -+ -+ task_environment_.RunUntilIdle(); - } - - // Tests if PlatformSensorReaderWinrtAbsOrientationQuaternion correctly -@@ -1242,32 +1391,32 @@ TEST_F(PlatformSensorReaderTestWinrt, CheckOrientationSensorReadingConversion) { - OrientationSensorReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = -- std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IOrientationSensorStatics** -- sensor_factory) -> HRESULT { -- return fake_sensor_factory.CopyTo(sensor_factory); -- })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor< -+ PlatformSensorReaderWinrtAbsOrientationQuaternion>(fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); -- EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -- .WillOnce(testing::Invoke([&](const SensorReading& reading) { -- EXPECT_EQ(expected_w, reading.orientation_quat.w); -- EXPECT_EQ(expected_x, reading.orientation_quat.x); -- EXPECT_EQ(expected_y, reading.orientation_quat.y); -- EXPECT_EQ(expected_z, reading.orientation_quat.z); -- })); -- - sensor->SetClient(mock_client.get()); -+ - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); - EXPECT_TRUE(sensor->StartSensor(sensor_config)); - - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, expected_w, expected_x, expected_y, - expected_z); -- fake_sensor->TriggerFakeSensorReading(reading); -+ { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(testing::Invoke([&](const SensorReading& reading) { -+ EXPECT_EQ(expected_w, reading.orientation_quat.w); -+ EXPECT_EQ(expected_x, reading.orientation_quat.x); -+ EXPECT_EQ(expected_y, reading.orientation_quat.y); -+ EXPECT_EQ(expected_z, reading.orientation_quat.z); -+ run_loop.Quit(); -+ })); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } - - sensor->StopSensor(); - } -@@ -1285,14 +1434,9 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedOrientationSampleParse) { - OrientationSensorReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = -- std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IOrientationSensorStatics** -- sensor_factory) -> HRESULT { -- return fake_sensor_factory.CopyTo(sensor_factory); -- })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor< -+ PlatformSensorReaderWinrtAbsOrientationQuaternion>(fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); - sensor->SetClient(mock_client.get()); -@@ -1303,12 +1447,17 @@ TEST_F(PlatformSensorReaderTestWinrt, FailedOrientationSampleParse) { - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, 0, 0, 0, 0); - -+ // We cannot use a base::RunLoop in the checks below because we are expecting -+ // that MockClient::OnReadingUpdate() does _not_ get called. -+ - reading->SetGetTimestampReturnCode(E_FAIL); - fake_sensor->TriggerFakeSensorReading(reading); - - reading->SetGetTimestampReturnCode(S_OK); - reading->SetGetQuaternionReturnCode(E_FAIL); - fake_sensor->TriggerFakeSensorReading(reading); -+ -+ task_environment_.RunUntilIdle(); - } - - TEST_F(PlatformSensorReaderTestWinrt, LightSensorThresholding) { -@@ -1321,29 +1470,30 @@ TEST_F(PlatformSensorReaderTestWinrt, LightSensorThresholding) { - ABI::Windows::Devices::Sensors::LightSensorReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::ILightSensorStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); -- -- bool expected_callback = false; -- EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -- .WillRepeatedly(testing::Invoke( -- [&](const SensorReading&) { EXPECT_TRUE(expected_callback); })); -- - sensor->SetClient(mock_client.get()); -+ - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); - EXPECT_TRUE(sensor->StartSensor(sensor_config)); - - float last_sent_lux = 1.0f; - auto threshold_helper = [&](bool expect_callback) { -- expected_callback = expect_callback; - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, last_sent_lux); -- fake_sensor->TriggerFakeSensorReading(reading); -+ if (expect_callback) { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(base::test::RunClosure(run_loop.QuitClosure())); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } else { -+ fake_sensor->TriggerFakeSensorReading(reading); -+ task_environment_.RunUntilIdle(); -+ } - }; - - // Expect callback, first sample -@@ -1359,10 +1509,6 @@ TEST_F(PlatformSensorReaderTestWinrt, LightSensorThresholding) { - PlatformSensorReaderWinrtLightSensor::kLuxPercentThreshold * 0.6f; - threshold_helper(true); - -- // Expect callback, threshold has been met exactly -- last_sent_lux += PlatformSensorReaderWinrtLightSensor::kLuxPercentThreshold; -- threshold_helper(true); -- - sensor->StopSensor(); - } - -@@ -1377,22 +1523,14 @@ TEST_F(PlatformSensorReaderTestWinrt, AccelerometerThresholding) { - Microsoft::WRL::Make()); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IAccelerometerStatics** -- sensor_factory) -> HRESULT { -- return fake_sensor_factory.CopyTo(sensor_factory); -- })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = -+ CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); -- -- bool expected_callback = false; -- EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -- .WillRepeatedly(testing::Invoke( -- [&](const SensorReading&) { EXPECT_TRUE(expected_callback); })); -- - sensor->SetClient(mock_client.get()); -+ - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); - EXPECT_TRUE(sensor->StartSensor(sensor_config)); - -@@ -1400,40 +1538,40 @@ TEST_F(PlatformSensorReaderTestWinrt, AccelerometerThresholding) { - double last_sent_y = 2.0f; - double last_sent_z = 3.0f; - auto threshold_helper = [&](bool expect_callback) { -- expected_callback = expect_callback; - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, last_sent_x, last_sent_y, - last_sent_z); -- fake_sensor->TriggerFakeSensorReading(reading); -+ if (expect_callback) { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(base::test::RunClosure(run_loop.QuitClosure())); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } else { -+ fake_sensor->TriggerFakeSensorReading(reading); -+ task_environment_.RunUntilIdle(); -+ } - }; - - // Expect callback, first sample - threshold_helper(true); - -- // No callback, threshold has not been met -+ // For each axis, increase its value by an amount lower than the threshold so -+ // that no callback is invoked, then meet the threshold and do expect a -+ // callback. - last_sent_x += PlatformSensorReaderWinrtAccelerometer::kAxisThreshold * 0.5f; - threshold_helper(false); -- last_sent_y += PlatformSensorReaderWinrtAccelerometer::kAxisThreshold * 0.5f; -- threshold_helper(false); -- last_sent_z += PlatformSensorReaderWinrtAccelerometer::kAxisThreshold * 0.5f; -- threshold_helper(false); -- -- // Expect callback, threshold has been met since last reported sample - last_sent_x += PlatformSensorReaderWinrtAccelerometer::kAxisThreshold * 0.6f; - threshold_helper(true); -+ last_sent_y += PlatformSensorReaderWinrtAccelerometer::kAxisThreshold * 0.5f; -+ threshold_helper(false); - last_sent_y += PlatformSensorReaderWinrtAccelerometer::kAxisThreshold * 0.6f; - threshold_helper(true); -+ last_sent_z += PlatformSensorReaderWinrtAccelerometer::kAxisThreshold * 0.5f; -+ threshold_helper(false); - last_sent_z += PlatformSensorReaderWinrtAccelerometer::kAxisThreshold * 0.6f; - threshold_helper(true); - -- // Expect callback, threshold has been met exactly -- last_sent_x += PlatformSensorReaderWinrtAccelerometer::kAxisThreshold; -- threshold_helper(true); -- last_sent_y += PlatformSensorReaderWinrtAccelerometer::kAxisThreshold; -- threshold_helper(true); -- last_sent_z += PlatformSensorReaderWinrtAccelerometer::kAxisThreshold; -- threshold_helper(true); -- - sensor->StopSensor(); - } - -@@ -1447,20 +1585,13 @@ TEST_F(PlatformSensorReaderTestWinrt, GyrometerThresholding) { - ABI::Windows::Devices::Sensors::GyrometerReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IGyrometerStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); -- -- bool expected_callback = false; -- EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -- .WillRepeatedly(testing::Invoke( -- [&](const SensorReading&) { EXPECT_TRUE(expected_callback); })); -- - sensor->SetClient(mock_client.get()); -+ - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); - EXPECT_TRUE(sensor->StartSensor(sensor_config)); - -@@ -1468,40 +1599,40 @@ TEST_F(PlatformSensorReaderTestWinrt, GyrometerThresholding) { - double last_sent_y = 4.0f; - double last_sent_z = 5.0f; - auto threshold_helper = [&](bool expect_callback) { -- expected_callback = expect_callback; - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, last_sent_x, last_sent_y, - last_sent_z); -- fake_sensor->TriggerFakeSensorReading(reading); -+ if (expect_callback) { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(base::test::RunClosure(run_loop.QuitClosure())); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } else { -+ fake_sensor->TriggerFakeSensorReading(reading); -+ task_environment_.RunUntilIdle(); -+ } - }; - - // Expect callback, first sample - threshold_helper(true); - -- // No callback, threshold has not been met -+ // For each axis, increase its value by an amount lower than the threshold so -+ // that no callback is invoked, then meet the threshold and do expect a -+ // callback. - last_sent_x += PlatformSensorReaderWinrtGyrometer::kDegreeThreshold * 0.5f; - threshold_helper(false); -- last_sent_y += PlatformSensorReaderWinrtGyrometer::kDegreeThreshold * 0.5f; -- threshold_helper(false); -- last_sent_z += PlatformSensorReaderWinrtGyrometer::kDegreeThreshold * 0.5f; -- threshold_helper(false); -- -- // Expect callback, threshold has been met since last reported sample - last_sent_x += PlatformSensorReaderWinrtGyrometer::kDegreeThreshold * 0.6f; - threshold_helper(true); -+ last_sent_y += PlatformSensorReaderWinrtGyrometer::kDegreeThreshold * 0.5f; -+ threshold_helper(false); - last_sent_y += PlatformSensorReaderWinrtGyrometer::kDegreeThreshold * 0.6f; - threshold_helper(true); -+ last_sent_z += PlatformSensorReaderWinrtGyrometer::kDegreeThreshold * 0.5f; -+ threshold_helper(false); - last_sent_z += PlatformSensorReaderWinrtGyrometer::kDegreeThreshold * 0.6f; - threshold_helper(true); - -- // Expect callback, threshold has been met exactly -- last_sent_x += PlatformSensorReaderWinrtGyrometer::kDegreeThreshold; -- threshold_helper(true); -- last_sent_y += PlatformSensorReaderWinrtGyrometer::kDegreeThreshold; -- threshold_helper(true); -- last_sent_z += PlatformSensorReaderWinrtGyrometer::kDegreeThreshold; -- threshold_helper(true); -- - sensor->StopSensor(); - } - -@@ -1515,20 +1646,14 @@ TEST_F(PlatformSensorReaderTestWinrt, MagnetometerThresholding) { - ABI::Windows::Devices::Sensors::MagnetometerReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IMagnetometerStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = -+ CreateAndInitializeSensor( -+ fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); -- -- bool expected_callback = false; -- EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -- .WillRepeatedly(testing::Invoke( -- [&](const SensorReading&) { EXPECT_TRUE(expected_callback); })); -- - sensor->SetClient(mock_client.get()); -+ - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); - EXPECT_TRUE(sensor->StartSensor(sensor_config)); - -@@ -1536,46 +1661,46 @@ TEST_F(PlatformSensorReaderTestWinrt, MagnetometerThresholding) { - double last_sent_y = 4.0f; - double last_sent_z = 5.0f; - auto threshold_helper = [&](bool expect_callback) { -- expected_callback = expect_callback; - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, last_sent_x, last_sent_y, - last_sent_z); -- fake_sensor->TriggerFakeSensorReading(reading); -+ if (expect_callback) { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(base::test::RunClosure(run_loop.QuitClosure())); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } else { -+ fake_sensor->TriggerFakeSensorReading(reading); -+ task_environment_.RunUntilIdle(); -+ } - }; - - // Expect callback, first sample - threshold_helper(true); - -- // No callback, threshold has not been met -+ // For each axis, increase its value by an amount lower than the threshold so -+ // that no callback is invoked, then meet the threshold and do expect a -+ // callback. - last_sent_x += - PlatformSensorReaderWinrtMagnetometer::kMicroteslaThreshold * 0.5f; - threshold_helper(false); -- last_sent_y += -- PlatformSensorReaderWinrtMagnetometer::kMicroteslaThreshold * 0.5f; -- threshold_helper(false); -- last_sent_z += -- PlatformSensorReaderWinrtMagnetometer::kMicroteslaThreshold * 0.5f; -- threshold_helper(false); -- -- // Expect callback, threshold has been met since last reported sample - last_sent_x += - PlatformSensorReaderWinrtMagnetometer::kMicroteslaThreshold * 0.6f; - threshold_helper(true); -+ last_sent_y += -+ PlatformSensorReaderWinrtMagnetometer::kMicroteslaThreshold * 0.5f; -+ threshold_helper(false); - last_sent_y += - PlatformSensorReaderWinrtMagnetometer::kMicroteslaThreshold * 0.6f; - threshold_helper(true); -+ last_sent_z += -+ PlatformSensorReaderWinrtMagnetometer::kMicroteslaThreshold * 0.5f; -+ threshold_helper(false); - last_sent_z += - PlatformSensorReaderWinrtMagnetometer::kMicroteslaThreshold * 0.6f; - threshold_helper(true); - -- // Expect callback, threshold has been met exactly -- last_sent_x += PlatformSensorReaderWinrtMagnetometer::kMicroteslaThreshold; -- threshold_helper(true); -- last_sent_y += PlatformSensorReaderWinrtMagnetometer::kMicroteslaThreshold; -- threshold_helper(true); -- last_sent_z += PlatformSensorReaderWinrtMagnetometer::kMicroteslaThreshold; -- threshold_helper(true); -- - sensor->StopSensor(); - } - -@@ -1589,21 +1714,13 @@ TEST_F(PlatformSensorReaderTestWinrt, AbsOrientationEulerThresholding) { - ABI::Windows::Devices::Sensors::InclinometerReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = -- std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IInclinometerStatics** sensor_factory) -- -> HRESULT { return fake_sensor_factory.CopyTo(sensor_factory); })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor< -+ PlatformSensorReaderWinrtAbsOrientationEulerAngles>(fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); -- -- bool expected_callback = false; -- EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -- .WillRepeatedly(testing::Invoke( -- [&](const SensorReading&) { EXPECT_TRUE(expected_callback); })); -- - sensor->SetClient(mock_client.get()); -+ - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); - EXPECT_TRUE(sensor->StartSensor(sensor_config)); - -@@ -1611,53 +1728,50 @@ TEST_F(PlatformSensorReaderTestWinrt, AbsOrientationEulerThresholding) { - double last_sent_y = 4.0f; - double last_sent_z = 5.0f; - auto threshold_helper = [&](bool expect_callback) { -- expected_callback = expect_callback; - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, last_sent_x, last_sent_y, - last_sent_z); -- fake_sensor->TriggerFakeSensorReading(reading); -+ if (expect_callback) { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(base::test::RunClosure(run_loop.QuitClosure())); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } else { -+ fake_sensor->TriggerFakeSensorReading(reading); -+ task_environment_.RunUntilIdle(); -+ } - }; - - // Expect callback, first sample - threshold_helper(true); - -- // No callback, threshold has not been met -+ // For each axis, increase its value by an amount lower than the threshold so -+ // that no callback is invoked, then meet the threshold and do expect a -+ // callback. - last_sent_x += - PlatformSensorReaderWinrtAbsOrientationEulerAngles::kDegreeThreshold * - 0.5f; - threshold_helper(false); -- last_sent_y += -- PlatformSensorReaderWinrtAbsOrientationEulerAngles::kDegreeThreshold * -- 0.5f; -- threshold_helper(false); -- last_sent_z += -- PlatformSensorReaderWinrtAbsOrientationEulerAngles::kDegreeThreshold * -- 0.5f; -- threshold_helper(false); -- -- // Expect callback, threshold has been met since last reported sample - last_sent_x += - PlatformSensorReaderWinrtAbsOrientationEulerAngles::kDegreeThreshold * - 0.6f; - threshold_helper(true); -+ last_sent_y += -+ PlatformSensorReaderWinrtAbsOrientationEulerAngles::kDegreeThreshold * -+ 0.5f; -+ threshold_helper(false); - last_sent_y += - PlatformSensorReaderWinrtAbsOrientationEulerAngles::kDegreeThreshold * - 0.6f; - threshold_helper(true); - last_sent_z += - PlatformSensorReaderWinrtAbsOrientationEulerAngles::kDegreeThreshold * -- 0.6f; -- threshold_helper(true); -- -- // Expect callback, threshold has been met exactly -- last_sent_x += -- PlatformSensorReaderWinrtAbsOrientationEulerAngles::kDegreeThreshold; -- threshold_helper(true); -- last_sent_y += -- PlatformSensorReaderWinrtAbsOrientationEulerAngles::kDegreeThreshold; -- threshold_helper(true); -+ 0.5f; -+ threshold_helper(false); - last_sent_z += -- PlatformSensorReaderWinrtAbsOrientationEulerAngles::kDegreeThreshold; -+ PlatformSensorReaderWinrtAbsOrientationEulerAngles::kDegreeThreshold * -+ 0.6f; - threshold_helper(true); - - sensor->StopSensor(); -@@ -1674,34 +1788,32 @@ TEST_F(PlatformSensorReaderTestWinrt, AbsOrientationQuatThresholding) { - OrientationSensorReadingChangedEventArgs>>(); - auto fake_sensor = fake_sensor_factory->fake_sensor_; - -- auto sensor = -- std::make_unique(); -- sensor->InitForTesting(base::BindLambdaForTesting( -- [&](ABI::Windows::Devices::Sensors::IOrientationSensorStatics** -- sensor_factory) -> HRESULT { -- return fake_sensor_factory.CopyTo(sensor_factory); -- })); -- EXPECT_TRUE(sensor->Initialize()); -+ auto sensor = CreateAndInitializeSensor< -+ PlatformSensorReaderWinrtAbsOrientationQuaternion>(fake_sensor_factory); -+ ASSERT_TRUE(sensor); - - auto mock_client = std::make_unique>(); -- -- bool expected_callback = false; -- EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -- .WillRepeatedly(testing::Invoke( -- [&](const SensorReading&) { EXPECT_TRUE(expected_callback); })); -- - sensor->SetClient(mock_client.get()); -+ - PlatformSensorConfiguration sensor_config(kExpectedReportFrequencySet); - EXPECT_TRUE(sensor->StartSensor(sensor_config)); - - double last_sent_rad = 1.0; - auto threshold_helper = [&](bool expect_callback) { -- expected_callback = expect_callback; - auto quat = gfx::Quaternion(gfx::Vector3dF(1.0, 0, 0), last_sent_rad); - auto reading = Microsoft::WRL::Make( - ABI::Windows::Foundation::DateTime{}, quat.w(), quat.x(), quat.y(), - quat.z()); -- fake_sensor->TriggerFakeSensorReading(reading); -+ if (expect_callback) { -+ base::RunLoop run_loop; -+ EXPECT_CALL(*mock_client, OnReadingUpdated(::testing::_)) -+ .WillOnce(base::test::RunClosure(run_loop.QuitClosure())); -+ fake_sensor->TriggerFakeSensorReading(reading); -+ run_loop.Run(); -+ } else { -+ fake_sensor->TriggerFakeSensorReading(reading); -+ task_environment_.RunUntilIdle(); -+ } - }; - - // Expect callback, first sample -@@ -1719,11 +1831,6 @@ TEST_F(PlatformSensorReaderTestWinrt, AbsOrientationQuatThresholding) { - 0.6f; - threshold_helper(true); - -- // Expect callback, threshold has been met exactly -- last_sent_rad += -- PlatformSensorReaderWinrtAbsOrientationQuaternion::kRadianThreshold; -- threshold_helper(true); -- - sensor->StopSensor(); - } - -diff --git a/chromium/services/device/generic_sensor/platform_sensor_win.cc b/chromium/services/device/generic_sensor/platform_sensor_win.cc -index 3ee3c1fa86a8..e9a78687250f 100644 ---- src/3rdparty/chromium/services/device/generic_sensor/platform_sensor_win.cc -+++ src/3rdparty/chromium/services/device/generic_sensor/platform_sensor_win.cc -@@ -43,6 +43,8 @@ double PlatformSensorWin::GetMaximumSupportedFrequency() { - } - - void PlatformSensorWin::OnReadingUpdated(const SensorReading& reading) { -+ // This function is normally called from |sensor_thread_runner_|, except on -+ // PlatformSensorAndProviderTestWin. - UpdateSharedBufferAndNotifyClients(reading); - } - -@@ -75,6 +77,7 @@ bool PlatformSensorWin::CheckSensorConfiguration( - } - - PlatformSensorWin::~PlatformSensorWin() { -+ DCHECK(main_task_runner()->RunsTasksInCurrentSequence()); - sensor_reader_->SetClient(nullptr); - sensor_thread_runner_->DeleteSoon(FROM_HERE, sensor_reader_.get()); - } -From dbafaa10eb690d68e0531313663f47c422dc8771 Mon Sep 17 00:00:00 2001 -From: kylechar -Date: Tue, 9 Apr 2024 17:14:26 +0000 -Subject: [PATCH] [Backport] CVE-2024-3157: Out of bounds write in Compositing - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5420432: -Validate buffer length - -The BitmapInSharedMemory mojo traits were only validating row length and -not total buffer length. - -(cherry picked from commit 1a19ff70bd54847d818566bd7a1e7c384c419746) - -(cherry picked from commit f15315f1cb7897e208947a40d538aac693283d7f) - -Bug: 331237485 -Change-Id: Ia2318899c44e9e7ac72fc7183954e6ce2c702179 -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5396796 -Commit-Queue: Kyle Charbonneau -Cr-Original-Original-Commit-Position: refs/heads/main@{#1278417} -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5420432 -Commit-Queue: danakj -Cr-Original-Commit-Position: refs/branch-heads/6312@{#786} -Cr-Original-Branched-From: 6711dcdae48edaf98cbc6964f90fac85b7d9986e-refs/heads/main@{#1262506} -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5433678 -Reviewed-by: danakj -Reviewed-by: Kyle Charbonneau -Cr-Commit-Position: refs/branch-heads/6099@{#2003} -Cr-Branched-From: e6ee4500f7d6549a9ac1354f8d056da49ef406be-refs/heads/main@{#1217362} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/554656 -Reviewed-by: Allan Sandfeld Jensen ---- - .../cpp/compositing/bitmap_in_shared_memory_mojom_traits.cc | 4 ++++ - 1 file changed, 4 insertions(+) - -diff --git a/chromium/services/viz/public/cpp/compositing/bitmap_in_shared_memory_mojom_traits.cc b/chromium/services/viz/public/cpp/compositing/bitmap_in_shared_memory_mojom_traits.cc -index a6e5f45d9e72..519d554055e5 100644 ---- src/3rdparty/chromium/services/viz/public/cpp/compositing/bitmap_in_shared_memory_mojom_traits.cc -+++ src/3rdparty/chromium/services/viz/public/cpp/compositing/bitmap_in_shared_memory_mojom_traits.cc -@@ -76,6 +76,10 @@ bool StructTraits::Read( - if (!mapping_ptr->IsValid()) - return false; - -+ if (mapping_ptr->size() < image_info.computeByteSize(data.row_bytes())) { -+ return false; -+ } -+ - if (!sk_bitmap->installPixels(image_info, mapping_ptr->memory(), - data.row_bytes(), &DeleteSharedMemoryMapping, - mapping_ptr.get())) { -From ac780f41ba9b3eb8329ca8e09b8857a070aed8c1 Mon Sep 17 00:00:00 2001 -From: Shahbaz Youssefi -Date: Mon, 25 Mar 2024 14:46:56 -0400 -Subject: [PATCH] [Backport] CVE-2024-3516: Heap buffer overflow in ANGLE - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/angle/angle/+/5391986: -Translator: Disallow samplers in structs in interface blocks - -As disallowed by the spec: - -> Types and declarators are the same as for other uniform variable -> declarations outside blocks, with these exceptions: -> -> * opaque types are not allowed - -Bug: chromium:328859176 -Change-Id: Ib94977860102329e520e635c3757827c93ca2163 -Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5391986 -Auto-Submit: Shahbaz Youssefi -Reviewed-by: Geoff Lang -Commit-Queue: Shahbaz Youssefi -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/554657 -Reviewed-by: Allan Sandfeld Jensen ---- - .../src/compiler/translator/ParseContext.cpp | 33 ++++++++++++------- - 1 file changed, 21 insertions(+), 12 deletions(-) - -diff --git a/chromium/third_party/angle/src/compiler/translator/ParseContext.cpp b/chromium/third_party/angle/src/compiler/translator/ParseContext.cpp -index e174725beb7..cb9eb3a4a56 100644 ---- src/3rdparty/chromium/third_party/angle/src/compiler/translator/ParseContext.cpp -+++ src/3rdparty/chromium/third_party/angle/src/compiler/translator/ParseContext.cpp -@@ -34,27 +34,39 @@ namespace - - const int kWebGLMaxStructNesting = 4; - --bool ContainsSampler(const TStructure *structType); -+struct IsSamplerFunc -+{ -+ bool operator()(TBasicType type) { return IsSampler(type); } -+}; -+struct IsOpaqueFunc -+{ -+ bool operator()(TBasicType type) { return IsOpaqueType(type); } -+}; -+ -+template -+bool ContainsOpaque(const TStructure *structType); - --bool ContainsSampler(const TType &type) -+template -+bool ContainsOpaque(const TType &type) - { -- if (IsSampler(type.getBasicType())) -+ if (OpaqueFunc{}(type.getBasicType())) - { - return true; - } - if (type.getBasicType() == EbtStruct) - { -- return ContainsSampler(type.getStruct()); -+ return ContainsOpaque(type.getStruct()); - } - - return false; - } - --bool ContainsSampler(const TStructure *structType) -+template -+bool ContainsOpaque(const TStructure *structType) - { - for (const auto &field : structType->fields()) - { -- if (ContainsSampler(*field->type())) -+ if (ContainsOpaque(*field->type())) - return true; - } - return false; -@@ -1057,7 +1069,7 @@ bool TParseContext::checkIsNotOpaqueType(const TSourceLoc &line, - { - if (pType.type == EbtStruct) - { -- if (ContainsSampler(pType.userDef)) -+ if (ContainsOpaque(pType.userDef)) - { - std::stringstream reasonStream = sh::InitializeStream(); - reasonStream << reason << " (structure contains a sampler)"; -@@ -4923,12 +4935,9 @@ TIntermDeclaration *TParseContext::addInterfaceBlock( - { - TField *field = (*fieldList)[memberIndex]; - TType *fieldType = field->type(); -- if (IsOpaqueType(fieldType->getBasicType())) -+ if (ContainsOpaque(*fieldType)) - { -- std::string reason("unsupported type - "); -- reason += fieldType->getBasicString(); -- reason += " types are not allowed in interface blocks"; -- error(field->line(), reason.c_str(), fieldType->getBasicString()); -+ error(field->line(), "Opaque types are not allowed in interface blocks", blockName); - } - - const TQualifier qualifier = fieldType->getQualifier(); -From a766045f65f934df3b5f1aa63bc86fbb3e003a09 Mon Sep 17 00:00:00 2001 -From: Anu Aliyas -Date: Wed, 17 Apr 2024 12:35:58 +0200 -Subject: [PATCH] Add missing dependencies to avoid compilation errors - -Missing dependencies are added to resolve the dependencies issues -encountered when compiling with Ninja 1.12.0 - -Fixes:QTBUG-124375 -Change-Id: I0f23ef6c60a6f01ee11bffd46121fd7f98dc022c -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/555586 -Reviewed-by: Michal Klocek ---- - chromium/content/public/browser/BUILD.gn | 1 + - chromium/extensions/browser/api/declarative_net_request/BUILD.gn | 1 + - 2 files changed, 2 insertions(+) - -diff --git a/chromium/content/public/browser/BUILD.gn b/chromium/content/public/browser/BUILD.gn -index d38fa8d303a..c5813115e88 100644 ---- src/3rdparty/chromium/content/public/browser/BUILD.gn -+++ src/3rdparty/chromium/content/public/browser/BUILD.gn -@@ -539,6 +539,7 @@ jumbo_source_set("browser_sources") { - "//cc", - "//components/services/storage/public/cpp", - "//components/viz/host", -+ "//components/spellcheck:buildflags", - "//content/browser", # Must not be public_deps! - "//device/fido", - "//gpu", -diff --git a/chromium/extensions/browser/api/declarative_net_request/BUILD.gn b/chromium/extensions/browser/api/declarative_net_request/BUILD.gn -index 1fc492f5a0c..13a266e22f1 100644 ---- src/3rdparty/chromium/extensions/browser/api/declarative_net_request/BUILD.gn -+++ src/3rdparty/chromium/extensions/browser/api/declarative_net_request/BUILD.gn -@@ -23,6 +23,7 @@ source_set("declarative_net_request") { - "//extensions/common", - "//extensions/common/api", - "//services/preferences/public/cpp", -+ "//components/web_cache/browser", - ] - - public_deps = [ "//extensions/browser:browser_sources" ] -From d26ab136f38d6bf3311eb04136820b85bc2fc96e Mon Sep 17 00:00:00 2001 -From: Dan Sanders -Date: Mon, 26 Feb 2024 20:53:06 +0000 -Subject: [PATCH] [Backport] Security bug 326521449 - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5323230: -Validate recovery_frame_cnt_ at time of use. - -Bug: b/326521449 -Change-Id: I778a16553bb3319dddfef6121895a89e0f1938df -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5323230 -Commit-Queue: Dan Sanders -Reviewed-by: Dale Curtis -Commit-Queue: Dale Curtis -Auto-Submit: Dan Sanders -Cr-Commit-Position: refs/heads/main@{#1265425} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/556725 -Reviewed-by: Michal Klocek ---- - chromium/media/gpu/h264_decoder.cc | 21 +++++++++++---------- - 1 file changed, 11 insertions(+), 10 deletions(-) - -diff --git a/chromium/media/gpu/h264_decoder.cc b/chromium/media/gpu/h264_decoder.cc -index 2bfdd28d83a..ef9de709045 100644 ---- src/3rdparty/chromium/media/gpu/h264_decoder.cc -+++ src/3rdparty/chromium/media/gpu/h264_decoder.cc -@@ -769,13 +769,6 @@ H264Decoder::H264Accelerator::Status H264Decoder::StartNewFrame( - return H264Accelerator::Status::kFail; - } - -- if (recovery_frame_cnt_ && *recovery_frame_cnt_ >= max_frame_num_) { -- DVLOG(1) << "Invalid recovery_frame_cnt=" << *recovery_frame_cnt_ -- << " (it must be less or equal to max_frame_num-1=" << max_frame_num_ - 1 -- << ")"; -- return H264Accelerator::Status::kFail; -- } -- - if (!InitCurrPicture(slice_hdr)) - return H264Accelerator::Status::kFail; - -@@ -999,11 +992,19 @@ bool H264Decoder::FinishPicture(scoped_refptr pic) { - DVLOG(4) << "Finishing picture frame_num: " << pic->frame_num - << ", entries in DPB: " << dpb_.size(); - if (recovery_frame_cnt_) { -- // This is the first picture after the recovery point SEI message. Computes -- // the frame_num of the frame that should be output from (Spec D.2.8). -+ // This is the first picture after the recovery point SEI message. Validate -+ // `recovery_frame_cnt_` now that we are certain to have max_frame_num_. -+ if (*recovery_frame_cnt_ >= max_frame_num_) { -+ DVLOG(1) << "Invalid recovery_frame_cnt=" << *recovery_frame_cnt_ -+ << " (must be less than or equal to max_frame_num-1=" -+ << (max_frame_num_ - 1) << ")"; -+ return false; -+ } -+ -+ // Compute the frame_num of the first frame that should be output (D.2.8). - recovery_frame_num_ = - (*recovery_frame_cnt_ + pic->frame_num) % max_frame_num_; -- DVLOG(3) << "recovery_frame_num_" << *recovery_frame_num_; -+ DVLOG(3) << "recovery_frame_num_=" << *recovery_frame_num_; - recovery_frame_cnt_.reset(); - } - -From 08e69b86a697e265b3e064b06a05fc5e7a4e079b Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Dominik=20R=C3=B6ttsches?= -Date: Thu, 14 Mar 2024 12:48:18 +0000 -Subject: [PATCH] [Backport] CVE-2024-3839: Out of bounds read in Fonts -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5361874: -Disable STAT sanitization/checks through OTS - -Due to issues in upstream, OTS STAT sanitization does not provide an -added security benefit. Pass-through the STAT table. - -Bug: chromium:41491859 -Change-Id: I19dcd87376af553afe242452396b951a74691f3c -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5361874 -Commit-Queue: Dominik Röttsches -Reviewed-by: Koji Ishii -Cr-Commit-Position: refs/heads/main@{#1272710} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/556726 -Reviewed-by: Michal Klocek ---- - .../blink/renderer/platform/fonts/web_font_decoder.cc | 2 ++ - 1 file changed, 2 insertions(+) - -diff --git a/chromium/third_party/blink/renderer/platform/fonts/web_font_decoder.cc b/chromium/third_party/blink/renderer/platform/fonts/web_font_decoder.cc -index 0953dc528dd..1ac9b8c9623 100644 ---- src/3rdparty/chromium/third_party/blink/renderer/platform/fonts/web_font_decoder.cc -+++ src/3rdparty/chromium/third_party/blink/renderer/platform/fonts/web_font_decoder.cc -@@ -104,6 +104,7 @@ ots::TableAction BlinkOTSContext::GetTableAction(uint32_t tag) { - const uint32_t kCpalTag = OTS_TAG('C', 'P', 'A', 'L'); - const uint32_t kCff2Tag = OTS_TAG('C', 'F', 'F', '2'); - const uint32_t kSbixTag = OTS_TAG('s', 'b', 'i', 'x'); -+ const uint32_t kStatTag = OTS_TAG('S', 'T', 'A', 'T'); - #if HB_VERSION_ATLEAST(1, 0, 0) - const uint32_t kBaseTag = OTS_TAG('B', 'A', 'S', 'E'); - const uint32_t kGdefTag = OTS_TAG('G', 'D', 'E', 'F'); -@@ -131,6 +132,7 @@ ots::TableAction BlinkOTSContext::GetTableAction(uint32_t tag) { - case kCpalTag: - case kCff2Tag: - case kSbixTag: -+ case kStatTag: - #if HB_VERSION_ATLEAST(1, 0, 0) - // Let HarfBuzz handle how to deal with broken tables. - case kAvarTag: -From 8755f5a5aafae5a0e74839042cd2f65dc86061e8 Mon Sep 17 00:00:00 2001 -From: Liza Burakova -Date: Wed, 21 Feb 2024 19:02:15 +0000 -Subject: [PATCH] [Backport] CVE-2024-3837: Use after free in QUIC - -Manual cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5268864: -Check if session is going away in Handle::RequestStream. - -This CL adds an extra check in the QuicChromiumClientSession -handle's RequestSession to make sure the session is not -marked as going away before creating a new StreamRequest. - -Bug: 41491379 -Change-Id: I687dfc23131871cdba345d3cf78dbbbd2e619ce9 -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5268864 -Reviewed-by: Kenichi Ishibashi -Commit-Queue: Liza Burakova -Cr-Commit-Position: refs/heads/main@{#1263483} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/556727 -Reviewed-by: Michal Klocek ---- - chromium/net/quic/quic_chromium_client_session.cc | 3 ++- - 1 file changed, 2 insertions(+), 1 deletion(-) - -diff --git a/chromium/net/quic/quic_chromium_client_session.cc b/chromium/net/quic/quic_chromium_client_session.cc -index d039d1ccb94..400006a170f 100644 ---- src/3rdparty/chromium/net/quic/quic_chromium_client_session.cc -+++ src/3rdparty/chromium/net/quic/quic_chromium_client_session.cc -@@ -454,7 +454,8 @@ int QuicChromiumClientSession::Handle::RequestStream( - const NetworkTrafficAnnotationTag& traffic_annotation) { - DCHECK(!stream_request_); - -- if (!session_) -+ // TODO(crbug.com/41491379): Add a regression test. -+ if (!session_ || session_->going_away_) - return ERR_CONNECTION_CLOSED; - - requires_confirmation |= session_->gquic_zero_rtt_disabled(); -From 271e21366ac1826df43119eb7b746019947be1f7 Mon Sep 17 00:00:00 2001 -From: Brendon Tiszka -Date: Sun, 3 Mar 2024 21:30:59 +0000 -Subject: [PATCH] [Backport] Security bug 327698060 - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5337387: -PaintOpReader: Harden PaintImage deserialization - -Add missing validity check after `Read` - -Bug: 327698060 -Change-Id: I0aa5120296009998af3235a01304a1f597a82a33 -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5337387 -Commit-Queue: Khushal Sagar -Reviewed-by: Khushal Sagar -Cr-Commit-Position: refs/heads/main@{#1267636} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/556748 -Reviewed-by: Michal Klocek ---- - chromium/cc/paint/paint_op_reader.cc | 3 +++ - 1 file changed, 3 insertions(+) - -diff --git a/chromium/cc/paint/paint_op_reader.cc b/chromium/cc/paint/paint_op_reader.cc -index 6d920c33562..7d1eb51441f 100644 ---- src/3rdparty/chromium/cc/paint/paint_op_reader.cc -+++ src/3rdparty/chromium/cc/paint/paint_op_reader.cc -@@ -351,6 +351,9 @@ void PaintOpReader::Read(PaintImage* image) { - case PaintOp::SerializedImageType::kImageData: { - SkColorType color_type; - Read(&color_type); -+ if (!valid_) { -+ return; -+ } - // Color types requiring alignment larger than kDefaultAlignment is not - // supported. - if (static_cast(SkColorTypeBytesPerPixel(color_type)) > -From 502983e6adc3db0d12ee8e9ff35d53df0e149870 Mon Sep 17 00:00:00 2001 -From: Pete Williamson -Date: Tue, 27 Feb 2024 00:19:05 +0000 -Subject: [PATCH] [Backport] Security bug 40940917 - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5293726: -Fix misalligned address in hunspell::NodeReader::ReaderForLookupAt - -With the Hunspell spell checking library, we are using a custom wrapper -to read the dictionaries from files. In that custom wrapper, we were -reading by using reinterpret_cast to interpret an offset into a pointer, -and then reading the bytes at that pointer for the child_offset. - -The spell checking code appears to have been working properly in the -field. However, the current code caused fuzzing test failures, and -those failures are blocking other tests, so we need to fix this to -unblock other tests. - -It turns out that we were casting a value to a pointer that did not -have proper alignment (for instance, a pointer to a 32 bit int needs -to be 4 byte allinged, but this pointer was not). While it has often -worked in older compilers, it turns out this is undefined behavior. - -Instead of relying on undefined behavior, the right thing to do is to -use std::memcpy to copy the bytes from the misalligned address into -their final destination (either an int32 or an int16 in this case). - -Bug: 40940917 -Change-Id: I8aeba9ee8000b51e98863813235d8dceb1c41ceb -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5293726 -Commit-Queue: Peter Williamson -Reviewed-by: Trevor Perrier -Cr-Commit-Position: refs/heads/main@{#1265552} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/556750 -Reviewed-by: Michal Klocek ---- - .../hunspell/google/bdict_reader.cc | 26 ++++++++++++++----- - 1 file changed, 20 insertions(+), 6 deletions(-) - -diff --git a/chromium/third_party/hunspell/google/bdict_reader.cc b/chromium/third_party/hunspell/google/bdict_reader.cc -index d51112ea48e7..56abd15dd121 100644 ---- src/3rdparty/chromium/third_party/hunspell/google/bdict_reader.cc -+++ src/3rdparty/chromium/third_party/hunspell/google/bdict_reader.cc -@@ -5,6 +5,7 @@ - #include "third_party/hunspell/google/bdict_reader.h" - - #include -+#include - - #include "base/check.h" - -@@ -413,19 +414,32 @@ NodeReader::FindResult NodeReader::ReaderForLookupAt( - if (index >= static_cast(lookup_num_chars()) || !is_valid_) - return FIND_DONE; - -- size_t child_offset; -+ size_t child_offset = 0; - if (is_lookup_32()) { - // Table contains 32-bit absolute offsets. -- child_offset = -- reinterpret_cast(table_begin)[index]; -+ -+ // We need to use memcpy here instead of just casting the offset into a -+ // pointer to an int because the cast can cause undefined behavior if -+ // the pointer is not alligned, and in this case it is not. -+ int byte_offset = index * sizeof(uint32_t); -+ std::memcpy(&child_offset, -+ reinterpret_cast(table_begin + byte_offset), -+ sizeof(uint32_t)); - if (!child_offset) - return FIND_NOTHING; // This entry in the table is empty. - } else { - // Table contains 16-bit offsets relative to the current node. -- child_offset = -- reinterpret_cast(table_begin)[index]; -- if (!child_offset) -+ -+ // We need to use memcpy here instead of just casting the offset into a -+ // pointer to an int because the cast can cause undefined behavior if -+ // the pointer is not alligned, and in this case it is not. -+ int byte_offset = index * sizeof(uint16_t); -+ std::memcpy(&child_offset, -+ reinterpret_cast(table_begin + byte_offset), -+ sizeof(uint16_t)); -+ if (!child_offset) { - return FIND_NOTHING; // This entry in the table is empty. -+ } - child_offset += node_offset_; - } - -From 6086d28d3a0dbfac1808ba5767ca1eea4a5acaf9 Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Marja=20H=C3=B6ltt=C3=A4?= -Date: Tue, 26 Mar 2024 13:53:21 +0000 -Subject: [PATCH] [Backport] CVE-2024-3914: Use after free in V8 (1/2) -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Manual backport of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5387887: -[M120-LTS] Fix DOMArrayBuffer::IsDetached() - -M120 merge issues: - third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc: - - Conflicting types for variable worlds - - Conflicting AllWorldsInIsolate() call (M120 doesn't use the last argument) - -A DOMArrayBuffer was maintaining its own "is_detached_" state, and -would consider itself non-detached even if the corresponding -JSArrayBuffer (or, all of them, in case there are several) was -detached. - -Piping in the v8::Isolate would be a too big change for this fix, so this is using v8::Isolate::GetCurrent() for now. - -Bug: 330759272 -Change-Id: I1e98ebd2066d2e59658db12f1bb419b6ebc1d706 -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5387887 -Commit-Queue: Marja Hölttä -Cr-Commit-Position: refs/heads/main@{#1278283} -(cherry picked from commit 04e7550d7aa3bf4ac4e49d7074972d357de139e6) -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/556751 -Reviewed-by: Michal Klocek ---- - .../core/typed_arrays/dom_array_buffer.cc | 50 +++++++++++++++++++ - .../core/typed_arrays/dom_array_buffer.h | 13 +++++ - .../core/typed_arrays/dom_array_buffer_base.h | 2 +- - 3 files changed, 64 insertions(+), 1 deletion(-) - -diff --git a/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc b/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc -index c195e28b442..197a4aebf5b 100644 ---- src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc -+++ src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc -@@ -48,6 +48,15 @@ static void AccumulateArrayBuffersForAllWorlds( - v8::Isolate* isolate, - DOMArrayBuffer* object, - Vector, 4>& buffers) { -+ if (!object->has_non_main_world_wrappers() && IsMainThread()) { -+ const DOMWrapperWorld& world = DOMWrapperWorld::MainWorld(); -+ v8::Local wrapper = world.DomDataStore().Get(object, isolate); -+ if (!wrapper.IsEmpty()) { -+ buffers.push_back(v8::Local::Cast(wrapper)); -+ } -+ return; -+ } -+ - Vector> worlds; - DOMWrapperWorld::AllWorldsInCurrentThread(worlds); - for (const auto& world : worlds) { -@@ -256,6 +265,47 @@ v8::MaybeLocal DOMArrayBuffer::Wrap(ScriptState* script_state) { - wrapper); - } - -+bool DOMArrayBuffer::IsDetached() const { -+ if (contents_.BackingStore() == nullptr) { -+ return is_detached_; -+ } -+ if (is_detached_) { -+ return true; -+ } -+ -+ v8::Isolate* isolate = v8::Isolate::GetCurrent(); -+ v8::HandleScope handle_scope(isolate); -+ Vector, 4> buffer_handles; -+ AccumulateArrayBuffersForAllWorlds(isolate, const_cast(this), buffer_handles); -+ -+ // There may be several v8::ArrayBuffers corresponding to the DOMArrayBuffer, -+ // but at most one of them may be non-detached. -+ int nondetached_count = 0; -+ int detached_count = 0; -+ -+ for (const auto& buffer_handle : buffer_handles) { -+ if (buffer_handle->WasDetached()) { -+ ++detached_count; -+ } else { -+ ++nondetached_count; -+ } -+ } -+ CHECK_LE(nondetached_count, 1); -+ -+ return nondetached_count == 0 && detached_count > 0; -+} -+ -+v8::Local DOMArrayBuffer::AssociateWithWrapper( -+ v8::Isolate* isolate, -+ const WrapperTypeInfo* wrapper_type_info, -+ v8::Local wrapper) { -+ if (!DOMWrapperWorld::Current(isolate).IsMainWorld()) { -+ has_non_main_world_wrappers_ = true; -+ } -+ return ScriptWrappable::AssociateWithWrapper(isolate, wrapper_type_info, -+ wrapper); -+} -+ - DOMArrayBuffer* DOMArrayBuffer::Slice(size_t begin, size_t end) const { - begin = std::min(begin, ByteLength()); - end = std::min(end, ByteLength()); -diff --git a/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h b/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h -index 87881af8787..84322ff31fc 100644 ---- src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h -+++ src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h -@@ -87,6 +87,17 @@ class CORE_EXPORT DOMArrayBuffer : public DOMArrayBufferBase { - - void Trace(Visitor*) const override; - -+ bool IsDetached() const override; -+ -+ v8::Local AssociateWithWrapper( -+ v8::Isolate* isolate, -+ const WrapperTypeInfo* wrapper_type_info, -+ v8::Local wrapper) override; -+ -+ bool has_non_main_world_wrappers() const { -+ return has_non_main_world_wrappers_; -+ } -+ - private: - v8::Maybe TransferDetachable(v8::Isolate*, - v8::Local detach_key, -@@ -97,6 +108,8 @@ class CORE_EXPORT DOMArrayBuffer : public DOMArrayBufferBase { - // support only v8::String as the detach key type. It's also convenient that - // we can write `array_buffer->SetDetachKey(isolate, "my key")`. - TraceWrapperV8Reference detach_key_; -+ -+ bool has_non_main_world_wrappers_ = false; - }; - - } // namespace blink -diff --git a/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer_base.h b/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer_base.h -index 95511438595..c83dc489c97 100644 ---- src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer_base.h -+++ src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer_base.h -@@ -27,7 +27,7 @@ class CORE_EXPORT DOMArrayBufferBase : public ScriptWrappable { - - size_t ByteLength() const { return contents_.DataLength(); } - -- bool IsDetached() const { return is_detached_; } -+ virtual bool IsDetached() const { return is_detached_; } - - void Detach() { is_detached_ = true; } - -From 92d5d3c528d5c4b22aa295b6b26303f174c0991b Mon Sep 17 00:00:00 2001 -From: =?UTF-8?q?Marja=20H=C3=B6ltt=C3=A4?= -Date: Thu, 4 Apr 2024 09:43:42 +0200 -Subject: [PATCH] [Backport] CVE-2024-3914: Use after free in V8 (2/2) -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Manual cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5419329: -[M120-LTS] Comment out a CHECK that a DOMAB has maximally one non-detached JSAB - -Based on crash reports, this assumption is not true and has to be -investigated. - -Removing this newly introduced CHECK to be able to merge fixes in this -area - we still violate this invariant but the fixes are a step into -the right direction. - -Fix in question: -https://chromium-review.googlesource.com/5387887 -which also introduced this CHECK. - -Bug: 330759272 -Change-Id: I4ba52fee7ed8f45e352efd347e87df03d896ac3d -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5419329 -Commit-Queue: Marja Hölttä -Cr-Commit-Position: refs/heads/main@{#1282379} -(cherry picked from commit 1e1e1bccfb84713fc325025eae43e746abcc115d) -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/556752 -Reviewed-by: Michal Klocek ---- - .../blink/renderer/core/typed_arrays/dom_array_buffer.cc | 6 +++++- - 1 file changed, 5 insertions(+), 1 deletion(-) - -diff --git a/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc b/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc -index 197a4aebf5b..796f45d7114 100644 ---- src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc -+++ src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc -@@ -290,7 +290,11 @@ bool DOMArrayBuffer::IsDetached() const { - ++nondetached_count; - } - } -- CHECK_LE(nondetached_count, 1); -+ // This CHECK fires even though it should not. TODO(330759272): Investigate -+ // under which conditions we end up with multiple non-detached JSABs for the -+ // same DOMAB and potentially restore this check. -+ -+ // CHECK_LE(nondetached_count, 1); - - return nondetached_count == 0 && detached_count > 0; - } -From 7ea70f94879b466b8319a52b786ae2ce3e47b737 Mon Sep 17 00:00:00 2001 -From: Dan McArdle -Date: Tue, 30 Jan 2024 22:20:43 +0000 -Subject: [PATCH] [Backport] Dependency for security bug 326498393 (1/2) - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5245970: -Prevent dangling pointer by inlining ScopedBusyTimeout - -Bug: 1522873 -Change-Id: Icd6262eb23404c273fa31021cddf36bea0bb56db -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5245970 -Reviewed-by: Evan Stade -Reviewed-by: David Benjamin -Commit-Queue: Dan McArdle -Cr-Commit-Position: refs/heads/main@{#1254220} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/556851 -Reviewed-by: Michal Klocek ---- - chromium/sql/database.cc | 48 +++++++++++++++------------------------- - 1 file changed, 18 insertions(+), 30 deletions(-) - -diff --git a/chromium/sql/database.cc b/chromium/sql/database.cc -index d5d350e85f4..5825127634a 100644 ---- src/3rdparty/chromium/sql/database.cc -+++ src/3rdparty/chromium/sql/database.cc -@@ -74,21 +74,6 @@ static constexpr char kSqliteOpenInMemoryPath[] = ":memory:"; - // TODO(shess): Better story on this. http://crbug.com/56559 - const int kBusyTimeoutSeconds = 1; - --class ScopedBusyTimeout { -- public: -- explicit ScopedBusyTimeout(sqlite3* db) : db_(db) {} -- ~ScopedBusyTimeout() { sqlite3_busy_timeout(db_, 0); } -- -- int SetTimeout(base::TimeDelta timeout) { -- DCHECK_LT(timeout.InMilliseconds(), INT_MAX); -- return sqlite3_busy_timeout(db_, -- static_cast(timeout.InMilliseconds())); -- } -- -- private: -- raw_ptr db_; --}; -- - // Helper to "safely" enable writable_schema. No error checking - // because it is reasonable to just forge ahead in case of an error. - // If turning it on fails, then most likely nothing will work, whereas -@@ -1405,22 +1390,14 @@ SqliteResultCode Database::ExecuteAndReturnResultCode(const char* sql) { - } - - bool Database::Execute(const char* sql) { -- TRACE_EVENT1("sql", "Database::Execute", "query", TRACE_STR_COPY(sql)); -- -- if (!db_) { -- DCHECK(poisoned_) << "Illegal use of Database without a db"; -- return false; -- } -+ TRACE_EVENT0("sql", "Database::Execute"); - -- SqliteResultCode sqlite_result_code = ExecuteAndReturnResultCode(sql); -- if (sqlite_result_code != SqliteResultCode::kOk) -- OnSqliteError(ToSqliteErrorCode(sqlite_result_code), nullptr, sql); -- -- return sqlite_result_code == SqliteResultCode::kOk; -+ return ExecuteWithTimeout(sql, base::TimeDelta()); - } - - bool Database::ExecuteWithTimeout(const char* sql, base::TimeDelta timeout) { -- TRACE_EVENT0("sql", "Database::ExecuteWithTimeout"); -+ TRACE_EVENT1("sql", "Database::ExecuteWithTimeout", "query", -+ TRACE_STR_COPY(sql)); - - DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); - if (!db_) { -@@ -1428,9 +1405,20 @@ bool Database::ExecuteWithTimeout(const char* sql, base::TimeDelta timeout) { - return false; - } - -- ScopedBusyTimeout busy_timeout(db_); -- busy_timeout.SetTimeout(timeout); -- return Execute(sql); -+ // Passing zero or a negative value to sqlite3_busy_timeout() would clear any -+ // busy handlers defined prior to this point. -+ if (timeout.is_positive()) { -+ DCHECK_LT(timeout.InMilliseconds(), INT_MAX); -+ sqlite3_busy_timeout(db_, static_cast(timeout.InMilliseconds())); -+ } -+ SqliteResultCode sqlite_result_code = ExecuteAndReturnResultCode(sql); -+ sqlite3_busy_timeout(db_, 0); -+ if (sqlite_result_code != SqliteResultCode::kOk) { -+ OnSqliteError(ToSqliteErrorCode(sqlite_result_code), nullptr, sql); -+ // At this point, `this` may have been modified or even deleted as a result -+ // of the caller-provided error callback. -+ } -+ return sqlite_result_code == SqliteResultCode::kOk; - } - - bool Database::ExecuteScriptForTesting(const char* sql_script) { -From 1e584e2b322c5bc8ff49a7a64375d969662242e1 Mon Sep 17 00:00:00 2001 -From: Dan McArdle -Date: Tue, 6 Feb 2024 23:15:33 +0000 -Subject: [PATCH] [Backport] Dependency for security bug 326498393 (2/2) - -Manual cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5245191: -Prevent dangling pointer in ScopedWritableSchema - -Bug: 1522873 -Change-Id: I71d7d178c98f2f2fc880762942fbca608d8cb81c -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5245191 -Reviewed-by: Evan Stade -Commit-Queue: Dan McArdle -Cr-Commit-Position: refs/heads/main@{#1257060} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/556852 -Reviewed-by: Michal Klocek ---- - chromium/sql/database.cc | 29 +++++++++++++++++++---------- - chromium/sql/database.h | 4 ++++ - 2 files changed, 23 insertions(+), 10 deletions(-) - -diff --git a/chromium/sql/database.cc b/chromium/sql/database.cc -index 5825127634a..54c7c44c7e2 100644 ---- src/3rdparty/chromium/sql/database.cc -+++ src/3rdparty/chromium/sql/database.cc -@@ -74,23 +74,29 @@ static constexpr char kSqliteOpenInMemoryPath[] = ":memory:"; - // TODO(shess): Better story on this. http://crbug.com/56559 - const int kBusyTimeoutSeconds = 1; - --// Helper to "safely" enable writable_schema. No error checking --// because it is reasonable to just forge ahead in case of an error. --// If turning it on fails, then most likely nothing will work, whereas --// if turning it off fails, it only matters if some code attempts to --// continue working with the database and tries to modify the -+// RAII-style wrapper that enables `writable_schema` until it goes out of scope. -+// No error checking on the PRAGMA statements because it is reasonable to just -+// forge ahead in case of an error. If turning it on fails, then most likely -+// nothing will work, whereas if turning it off fails, it only matters if some -+// code attempts to continue working with the database and tries to modify the - // sqlite_schema table (none of our code does this). - class ScopedWritableSchema { - public: -- explicit ScopedWritableSchema(sqlite3* db) : db_(db) { -- sqlite3_exec(db_, "PRAGMA writable_schema=1", nullptr, nullptr, nullptr); -+ explicit ScopedWritableSchema(base::WeakPtr db) -+ : db_(std::move(db)) { -+ CHECK(db_->is_open()); -+ std::ignore = db_->Execute("PRAGMA writable_schema=1"); - } - ~ScopedWritableSchema() { -- sqlite3_exec(db_, "PRAGMA writable_schema=0", nullptr, nullptr, nullptr); -+ // Database invalidates its WeakPtrs before closing the SQLite connection. -+ if (db_) { -+ CHECK(db_->is_open()); -+ std::ignore = db_->Execute("PRAGMA writable_schema=0"); -+ } - } - - private: -- raw_ptr db_; -+ const base::WeakPtr db_; - }; - - // Raze() helper that uses SQLite's online backup API. -@@ -386,6 +392,9 @@ void Database::CloseInternal(bool forced) { - std::move(memory_dump_provider_)); - } - -+ // Invalidate any `WeakPtr`s held by scoping helpers. -+ weak_factory_.InvalidateWeakPtrs(); -+ - auto sqlite_result_code = ToSqliteResultCode(sqlite3_close(db_)); - - DCHECK_NE(sqlite_result_code, SqliteResultCode::kBusy) -@@ -1014,7 +1023,7 @@ bool Database::Raze() { - // sqlite3.c lockBtree().] - // TODO(shess): With this, "PRAGMA auto_vacuum" and "PRAGMA - // page_size" can be used to query such a database. -- ScopedWritableSchema writable_schema(db_); -+ ScopedWritableSchema writable_schema(weak_factory_.GetWeakPtr()); - - #if BUILDFLAG(IS_WIN) - // On Windows, truncate silently fails when applied to memory-mapped files. -diff --git a/chromium/sql/database.h b/chromium/sql/database.h -index 79172875fda..71a2f672221 100644 ---- src/3rdparty/chromium/sql/database.h -+++ src/3rdparty/chromium/sql/database.h -@@ -24,6 +24,7 @@ - #include "base/memory/raw_ptr.h" - #include "base/memory/raw_ptr_exclusion.h" - #include "base/memory/ref_counted.h" -+#include "base/memory/weak_ptr.h" - #include "base/sequence_checker.h" - #include "base/strings/string_piece.h" - #include "base/threading/scoped_blocking_call.h" -@@ -1021,6 +1022,9 @@ class COMPONENT_EXPORT(SQL) Database { - - // Stores the dump provider object when db is open. - std::unique_ptr memory_dump_provider_; -+ -+ // Vends WeakPtr for internal scoping helpers. -+ base::WeakPtrFactory weak_factory_{this}; - }; - - } // namespace sql -From 1ea3a7dc0b8e1f779f0ff047799cce884bb9986a Mon Sep 17 00:00:00 2001 -From: Dan McArdle -Date: Thu, 29 Feb 2024 17:08:14 +0000 -Subject: [PATCH] [Backport] Security bug 326498393 - -Manual backport of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5320373: -SQL: Make sql::Transaction hold WeakPtr - -Now, Transaction checks whether the Database has been destroyed before -using it. - -This CL also adds stricter sequence checking to Database, which found a -few places that Database was passed between sequences: - -(1) storage::DatabaseTracker was using and destroying sql::Database on - different sequences. Now, it simply destroys the Database instance - in storage::DatabaseTracker::Shutdown(), which already runs on the - correct sequence. - -(1) history::InMemoryDatabase was "slurping" data from disk on one - sequence, then querying the data on a different sequence. To support - this use case, we added added sql:Database::DetachFromSequence(). - Now, InMemoryDatabase effectively annotates the cut point where the - Database is handed off to another sequence. - -Bug: 326498393 -Change-Id: I866061feaf08d48607d97731a512bc02ce497f71 -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5320373 -Reviewed-by: manuk hovanesian -Commit-Queue: Dan McArdle -Reviewed-by: Evan Stade -Auto-Submit: Dan McArdle -Cr-Commit-Position: refs/heads/main@{#1267047} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/556853 -Reviewed-by: Michal Klocek ---- - .../history/core/browser/in_memory_database.cc | 3 +++ - chromium/sql/database.cc | 16 ++++++++++++++++ - chromium/sql/database.h | 12 ++++++++++-- - chromium/sql/internal_api_token.h | 1 + - chromium/sql/transaction.cc | 17 ++++++++++++++--- - chromium/sql/transaction.h | 4 ++-- - .../browser/database/database_tracker.cc | 8 ++++++++ - .../storage/browser/database/database_tracker.h | 4 +++- - 8 files changed, 57 insertions(+), 8 deletions(-) - -diff --git a/chromium/components/history/core/browser/in_memory_database.cc b/chromium/components/history/core/browser/in_memory_database.cc -index ad9c02696e3c..d139ddc45112 100644 ---- src/3rdparty/chromium/components/history/core/browser/in_memory_database.cc -+++ src/3rdparty/chromium/components/history/core/browser/in_memory_database.cc -@@ -122,6 +122,9 @@ bool InMemoryDatabase::InitFromDisk(const base::FilePath& history_name) { - // inserting into it. - CreateMainURLIndex(); - -+ // After this point, the database may be accessed from another sequence. -+ db_.DetachFromSequence(); -+ - return true; - } - -diff --git a/chromium/sql/database.cc b/chromium/sql/database.cc -index 54c7c44c7e26..b69e4c968c56 100644 ---- src/3rdparty/chromium/sql/database.cc -+++ src/3rdparty/chromium/sql/database.cc -@@ -45,6 +45,7 @@ - #include "build/build_config.h" - #include "sql/database_memory_dump_provider.h" - #include "sql/initialization.h" -+#include "sql/internal_api_token.h" - #include "sql/meta_table.h" - #include "sql/sql_features.h" - #include "sql/sqlite_result_code.h" -@@ -221,6 +222,11 @@ base::FilePath Database::SharedMemoryFilePath(const base::FilePath& db_path) { - return base::FilePath(db_path.value() + FILE_PATH_LITERAL("-shm")); - } - -+base::WeakPtr Database::GetWeakPtr(InternalApiToken) { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); -+ return weak_factory_.GetWeakPtr(); -+} -+ - Database::StatementRef::StatementRef(Database* database, - sqlite3_stmt* stmt, - bool was_valid) -@@ -341,6 +347,11 @@ bool Database::OpenInMemory() { - return OpenInternal(kSqliteOpenInMemoryPath, OpenMode::kInMemory); - } - -+void Database::DetachFromSequence() { -+ DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); -+ DETACH_FROM_SEQUENCE(sequence_checker_); -+} -+ - bool Database::OpenTemporary(base::PassKey) { - TRACE_EVENT0("sql", "Database::OpenTemporary"); - -@@ -350,6 +361,9 @@ bool Database::OpenTemporary(base::PassKey) { - - void Database::CloseInternal(bool forced) { - TRACE_EVENT0("sql", "Database::CloseInternal"); -+ -+ DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); -+ - // TODO(shess): Calling "PRAGMA journal_mode = DELETE" at this point - // will delete the -journal file. For ChromiumOS or other more - // embedded systems, this is probably not appropriate, whereas on -@@ -966,6 +980,8 @@ void Database::TrimMemory() { - bool Database::Raze() { - TRACE_EVENT0("sql", "Database::Raze"); - -+ DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); -+ - absl::optional scoped_blocking_call; - InitScopedBlockingCall(FROM_HERE, &scoped_blocking_call); - -diff --git a/chromium/sql/database.h b/chromium/sql/database.h -index 71a2f6722219..2570aade0157 100644 ---- src/3rdparty/chromium/sql/database.h -+++ src/3rdparty/chromium/sql/database.h -@@ -27,6 +27,7 @@ - #include "base/memory/weak_ptr.h" - #include "base/sequence_checker.h" - #include "base/strings/string_piece.h" -+#include "base/thread_annotations.h" - #include "base/threading/scoped_blocking_call.h" - #include "base/types/pass_key.h" - #include "sql/internal_api_token.h" -@@ -261,8 +262,10 @@ struct COMPONENT_EXPORT(SQL) DatabaseDiagnostics { - - // Handle to an open SQLite database. - // --// Instances of this class are not thread-safe. After construction, a Database --// instance should only be accessed from one sequence. -+// Instances of this class are not thread-safe. With few exceptions, Database -+// instances should only be accessed from one sequence. Database instances may -+// be constructed on one sequence and safely used/destroyed on another. Callers -+// may explicitly use `DetachFromSequence()` before moving to another sequence. - // - // When a Database instance goes out of scope, any uncommitted transactions are - // rolled back. -@@ -394,6 +397,10 @@ class COMPONENT_EXPORT(SQL) Database { - // Returns true if the database has been successfully opened. - bool is_open() const; - -+ // Detach from the currently-attached sequence. If already attached to a -+ // sequence, this method must be called from that sequence. -+ void DetachFromSequence(); -+ - // Closes the database. This is automatically performed on destruction for - // you, but this allows you to close the database early. You must not call - // any other functions after closing it. It is permissable to call Close on -@@ -700,6 +707,7 @@ class COMPONENT_EXPORT(SQL) Database { - static base::FilePath SharedMemoryFilePath(const base::FilePath& db_path); - - // Internal state accessed by other classes in //sql. -+ base::WeakPtr GetWeakPtr(InternalApiToken); - sqlite3* db(InternalApiToken) const { return db_; } - bool poisoned(InternalApiToken) const { return poisoned_; } - base::FilePath DbPath(InternalApiToken) const { return DbPath(); } -diff --git a/chromium/sql/internal_api_token.h b/chromium/sql/internal_api_token.h -index c71b70309ee9..d9ec0b834f8e 100644 ---- src/3rdparty/chromium/sql/internal_api_token.h -+++ src/3rdparty/chromium/sql/internal_api_token.h -@@ -28,6 +28,7 @@ class InternalApiToken { - friend class BuiltInRecovery; - friend class DatabaseTestPeer; - friend class Recovery; -+ friend class Transaction; - friend struct test::ColumnInfo; - friend bool test::CorruptSizeInHeader(const base::FilePath&); - }; -diff --git a/chromium/sql/transaction.cc b/chromium/sql/transaction.cc -index a8d85b67fbd7..71bc7381b55f 100644 ---- src/3rdparty/chromium/sql/transaction.cc -+++ src/3rdparty/chromium/sql/transaction.cc -@@ -7,11 +7,13 @@ - #include "base/check.h" - #include "base/sequence_checker.h" - #include "sql/database.h" -+#include "sql/internal_api_token.h" - - namespace sql { - --Transaction::Transaction(Database* database) : database_(*database) { -- DCHECK(database); -+Transaction::Transaction(Database* database) { -+ CHECK(database); -+ database_ = database->GetWeakPtr(InternalApiToken{}); - } - - Transaction::~Transaction() { -@@ -21,7 +23,7 @@ Transaction::~Transaction() { - << "Begin() not called immediately after Transaction creation"; - #endif // DCHECK_IS_ON() - -- if (is_active_) -+ if (is_active_ && database_ && database_->is_open()) - database_->RollbackTransaction(); - } - -@@ -33,6 +35,9 @@ bool Transaction::Begin() { - #endif // DCHECK_IS_ON() - - DCHECK(!is_active_); -+ if (!database_) { -+ return false; -+ } - is_active_ = database_->BeginTransaction(); - return is_active_; - } -@@ -49,6 +54,9 @@ void Transaction::Rollback() { - DCHECK(is_active_) << __func__ << " called after Begin() failed"; - is_active_ = false; - -+ if (!database_) { -+ return; -+ } - database_->RollbackTransaction(); - } - -@@ -63,6 +71,9 @@ bool Transaction::Commit() { - - DCHECK(is_active_) << __func__ << " called after Begin() failed"; - is_active_ = false; -+ if (!database_) { -+ return false; -+ } - return database_->CommitTransaction(); - } - -diff --git a/chromium/sql/transaction.h b/chromium/sql/transaction.h -index 54573bcf98d2..8e20d7fe737a 100644 ---- src/3rdparty/chromium/sql/transaction.h -+++ src/3rdparty/chromium/sql/transaction.h -@@ -7,7 +7,7 @@ - - #include "base/check.h" - #include "base/component_export.h" --#include "base/memory/raw_ref.h" -+#include "base/memory/weak_ptr.h" - #include "base/sequence_checker.h" - #include "base/thread_annotations.h" - -@@ -91,7 +91,7 @@ class COMPONENT_EXPORT(SQL) Transaction { - private: - SEQUENCE_CHECKER(sequence_checker_); - -- const raw_ref database_ GUARDED_BY_CONTEXT(sequence_checker_); -+ base::WeakPtr database_ GUARDED_BY_CONTEXT(sequence_checker_); - - #if DCHECK_IS_ON() - bool begin_called_ GUARDED_BY_CONTEXT(sequence_checker_) = false; -diff --git a/chromium/storage/browser/database/database_tracker.cc b/chromium/storage/browser/database/database_tracker.cc -index 2926db89bac4..5dbfcf2d4227 100644 ---- src/3rdparty/chromium/storage/browser/database/database_tracker.cc -+++ src/3rdparty/chromium/storage/browser/database/database_tracker.cc -@@ -4,6 +4,7 @@ - - #include "storage/browser/database/database_tracker.h" - -+#include - #include - - #include -@@ -986,6 +987,13 @@ void DatabaseTracker::Shutdown() { - else if (!force_keep_session_state_) - ClearSessionOnlyOrigins(); - CloseTrackerDatabaseAndClearCaches(); -+ -+ // Explicitly destroy `db_` on the correct sequence rather than waiting for -+ // the destructor, which may run on another sequence. Destroy related fields -+ // first to prevent dangling pointers. Destruction order is important. -+ meta_table_.reset(); -+ databases_table_.reset(); -+ db_.reset(); - } - - void DatabaseTracker::SetForceKeepSessionState() { -diff --git a/chromium/storage/browser/database/database_tracker.h b/chromium/storage/browser/database/database_tracker.h -index 17b6aea42766..57d189e338d3 100644 ---- src/3rdparty/chromium/storage/browser/database/database_tracker.h -+++ src/3rdparty/chromium/storage/browser/database/database_tracker.h -@@ -77,7 +77,9 @@ class COMPONENT_EXPORT(STORAGE_BROWSER) OriginInfo { - // The data in this class is not thread-safe, so all methods of this class - // should be called on the task runner returned by task_runner(). The only - // exceptions are the constructor, the destructor, and the getters explicitly --// marked as thread-safe. -+// marked as thread-safe. Although the destructor itself may run on any thread, -+// destruction effectively occurs in Shutdown(), which expects to be called on -+// task_runner(). - class COMPONENT_EXPORT(STORAGE_BROWSER) DatabaseTracker - : public base::RefCountedThreadSafe { - public: -From aea30bc1019793100c4586d499fa7f82ff18613b Mon Sep 17 00:00:00 2001 -From: Liam Brady -Date: Thu, 7 Mar 2024 22:11:26 +0000 -Subject: [PATCH] [Backport] CVE-2024-3840: Insufficient policy enforcement in - Site Isolation -MIME-Version: 1.0 -Content-Type: text/plain; charset=UTF-8 -Content-Transfer-Encoding: 8bit - -Manual cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5269464: -Clear user activation on cross-site navigations. - -When full site isolation is disabled, renderer processes and -RenderFrameHosts are re-used when performing cross-site navigations. -This includes user activation state, and, more specifically, the sticky -`has_been_active_` bit in `UserActivationState`. - -Currently, the `UserActivationState` on the renderer-side is reset only -if the navigation's associated frame is a main frame. That means that if -an iframe navigates to a cross-site page, its sticky user activation -state will be the leftover state from the previous page. So, if a user -interacted with the previous page in any capacity, the newly loaded page -will think it has received a user gesture, essentially using an -unintentional cache of the user activation state. - -This becomes an issue when dealing with our framebusting interventions. -We only allow an iframe to do a top-level navigation if it received a -user gesture. However, if an iframe's previous document received a user -activation, or worse, if the iframe was not navigated to anything and -got a user activation because its embedder was interacted with, this -allows the current document to circumvent our framebusting -interventions. The latter happens because of same-origin descendant -activation behavior. See: -https://source.chromium.org/chromium/chromium/src/+/main:content/browser/renderer_host/frame_tree_node.cc;l=766-778;drc=30753b1135fa271a3b45bbdbfef6567e46733a7f;bpv=1;bpt=1 - -Note that this problem does not exist if site isolation is enabled -(which is by default on desktop platforms), since a cross-site -navigation will create a whole new process with a fresh -`UserActivationState`. - -To fix this, this CL clears the user activation state on cross-site -subframe navigations in the renderer (user activation is already cleared -for main frames). To ensure that same-site navigations persist user -state even if a cross-origin or same-origin navigation results in a new -process or RenderFrameHost being created, this CL also explicitly -transfers sticky user activation state for all same-site -cross-RenderFrameHost navigations. This takes place in the browser, and -the resulting bit to determine if a frame should have sticky user -activation is passed to the renderer. - -The ultimate end goal is to unconditionally clear the user activation -state for all cross-document navigations. That unfortunately is not -possible today as there are entrenched use cases that rely on sticky -user activation state being cached for same-site navigations. See: -https://crbug.com/40228985. - -This CL also fixes the aforementioned regression when enabling the -RenderDocument feature, since this CL will now preserve the sticky user -activation state regardless of what -process/RenderFrameHost/RenderDocument state the navigation results in. - -This CL adds some tests to the no-auto-wpt-origin-isolation test suite, which requires some additional description: - -* These tests are running on all platforms because site isolation behavior may differ per platform -* All of the tests in the-iframe-element are being added because it would be useful to understand their behavior in all expected process -configurations -* The total time taken for this test suite on linux-rel showed a total time percentage of <0.3% - -Bug: 41493458 -Change-Id: Ibec11437fcd03470571e04a4e0dfaadffddf6c03 -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5269464 -Reviewed-by: Mustaq Ahmed -Reviewed-by: Charlie Reis -Reviewed-by: Jeremy Roman -Reviewed-by: Robert Flack -Reviewed-by: Andrew Verge -Commit-Queue: Liam Brady -Reviewed-by: Alex Moshchuk -Reviewed-by: danakj -Cr-Commit-Position: refs/heads/main@{#1269856} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/556966 -Reviewed-by: Michael Brüning ---- - .../browser/renderer_host/frame_tree_node.cc | 30 ++++++++--------- - .../browser/renderer_host/frame_tree_node.h | 15 ++++----- - .../navigation_controller_impl.cc | 4 ++- - .../renderer_host/navigation_entry_impl.cc | 5 +-- - .../renderer_host/navigation_request.cc | 29 ++++++++++++---- - .../browser/renderer_host/navigator.cc | 33 +++++++++++++++---- - .../renderer_host/render_frame_host_impl.cc | 11 +++++-- - .../renderer_host/render_frame_host_impl.h | 3 +- - .../content/renderer/render_frame_impl.cc | 3 ++ - .../common/frame/user_activation_state.cc | 4 +++ - .../common/frame/user_activation_state.h | 4 +++ - .../frame/user_activation_update_types.mojom | 8 +++++ - .../mojom/navigation/navigation_params.mojom | 4 +++ - .../blink/public/web/web_navigation_params.h | 4 +++ - .../blink/renderer/core/frame/frame.cc | 21 ++++++++++-- - .../blink/renderer/core/frame/frame.h | 10 +++++- - .../blink/renderer/core/frame/remote_frame.cc | 3 ++ - .../renderer/core/loader/document_loader.cc | 21 ++++++++++-- - .../renderer/core/loader/document_loader.h | 4 +++ - 19 files changed, 164 insertions(+), 52 deletions(-) - -diff --git a/chromium/content/browser/renderer_host/frame_tree_node.cc b/chromium/content/browser/renderer_host/frame_tree_node.cc -index dd618cfa09e5..1ed5a5e0f004 100644 ---- src/3rdparty/chromium/content/browser/renderer_host/frame_tree_node.cc -+++ src/3rdparty/chromium/content/browser/renderer_host/frame_tree_node.cc -@@ -338,19 +338,6 @@ bool FrameTreeNode::IsOutermostMainFrame() const { - return !GetParentOrOuterDocument(); - } - --void FrameTreeNode::ResetForNavigation() { -- // This frame has had its user activation bits cleared in the renderer before -- // arriving here. We just need to clear them here and in the other renderer -- // processes that may have a reference to this frame. -- // -- // We do not take user activation into account when calculating -- // |ResetForNavigationResult|, as we are using it to determine bfcache -- // eligibility and the page can get another user gesture after restore. -- UpdateUserActivationState( -- blink::mojom::UserActivationUpdateType::kClearActivation, -- blink::mojom::UserActivationNotificationType::kNone); --} -- - RenderFrameHostImpl* FrameTreeNode::GetParentOrOuterDocument() const { - return GetParentOrOuterDocumentHelper(/*escape_guest_view=*/false, - /*include_prospective=*/true); -@@ -769,15 +756,22 @@ void FrameTreeNode::BeforeUnloadCanceled() { - } - } - -+bool FrameTreeNode::NotifyUserActivationStickyOnly() { -+ return NotifyUserActivation( -+ blink::mojom::UserActivationNotificationType::kNone, -+ /*sticky_only=*/true); -+} -+ - bool FrameTreeNode::NotifyUserActivation( -- blink::mojom::UserActivationNotificationType notification_type) { -+ blink::mojom::UserActivationNotificationType notification_type, -+ bool sticky_only) { - // User Activation V2 requires activating all ancestor frames in addition to - // the current frame. See - // https://html.spec.whatwg.org/multipage/interaction.html#tracking-user-activation. - for (RenderFrameHostImpl* rfh = current_frame_host(); rfh; - rfh = rfh->GetParent()) { - rfh->DidReceiveUserActivation(); -- rfh->ActivateUserActivation(notification_type); -+ rfh->ActivateUserActivation(notification_type, sticky_only); - } - - current_frame_host()->browsing_context_state()->set_has_active_user_gesture( -@@ -792,7 +786,8 @@ bool FrameTreeNode::NotifyUserActivation( - for (FrameTreeNode* node : frame_tree().Nodes()) { - if (node->current_frame_host()->GetLastCommittedOrigin().IsSameOriginWith( - current_origin)) { -- node->current_frame_host()->ActivateUserActivation(notification_type); -+ node->current_frame_host()->ActivateUserActivation(notification_type, -+ sticky_only); - } - } - } -@@ -860,6 +855,9 @@ bool FrameTreeNode::UpdateUserActivationState( - return false; - } - } break; -+ case blink::mojom::UserActivationUpdateType::kNotifyActivationStickyOnly: -+ update_result = NotifyUserActivationStickyOnly(); -+ break; - case blink::mojom::UserActivationUpdateType::kClearActivation: - update_result = ClearUserActivation(); - break; -diff --git a/chromium/content/browser/renderer_host/frame_tree_node.h b/chromium/content/browser/renderer_host/frame_tree_node.h -index 0edd7b389cc3..284a81e467dd 100644 ---- src/3rdparty/chromium/content/browser/renderer_host/frame_tree_node.h -+++ src/3rdparty/chromium/content/browser/renderer_host/frame_tree_node.h -@@ -122,14 +122,6 @@ class CONTENT_EXPORT FrameTreeNode : public RenderFrameHostOwner { - bool IsMainFrame() const; - bool IsOutermostMainFrame() const; - -- // Clears any state in this node which was set by the document itself (CSP & -- // UserActivationState) and notifies proxies as appropriate. Invoked after -- // committing navigation to a new document (since the new document comes with -- // a fresh set of CSP). -- // TODO(arthursonzogni): Remove this function. The frame/document must not be -- // left temporarily with lax state. -- void ResetForNavigation(); -- - FrameTree& frame_tree() const { return frame_tree_.get(); } - Navigator& navigator(); - -@@ -772,8 +764,13 @@ class CONTENT_EXPORT FrameTreeNode : public RenderFrameHostOwner { - class OpenerDestroyedObserver; - - // The |notification_type| parameter is used for histograms only. -+ // |sticky_only| is set to true when propagating sticky user activation during -+ // cross-document navigations. The transient state remains unchanged. - bool NotifyUserActivation( -- blink::mojom::UserActivationNotificationType notification_type); -+ blink::mojom::UserActivationNotificationType notification_type, -+ bool sticky_only = false); -+ -+ bool NotifyUserActivationStickyOnly(); - - bool ConsumeTransientUserActivation(); - -diff --git a/chromium/content/browser/renderer_host/navigation_controller_impl.cc b/chromium/content/browser/renderer_host/navigation_controller_impl.cc -index 24203784c631..54e064642bdc 100644 ---- src/3rdparty/chromium/content/browser/renderer_host/navigation_controller_impl.cc -+++ src/3rdparty/chromium/content/browser/renderer_host/navigation_controller_impl.cc -@@ -3979,7 +3979,9 @@ NavigationControllerImpl::CreateNavigationRequestFromLoadParams( - /*origin_agent_cluster_left_as_default=*/true, - /*enabled_client_hints=*/ - std::vector(), -- /*is_cross_browsing_instance=*/false, /*old_page_info=*/nullptr, -+ /*is_cross_site_cross_browsing_context_group=*/false, -+ /*should_have_sticky_user_activation=*/false, -+ /*old_page_info=*/nullptr, - /*http_response_code=*/-1, - blink::mojom::NavigationApiHistoryEntryArrays::New(), - /*early_hints_preloaded_resources=*/std::vector(), -diff --git a/chromium/content/browser/renderer_host/navigation_entry_impl.cc b/chromium/content/browser/renderer_host/navigation_entry_impl.cc -index 1c318ac954ed..897fb61b887d 100644 ---- src/3rdparty/chromium/content/browser/renderer_host/navigation_entry_impl.cc -+++ src/3rdparty/chromium/content/browser/renderer_host/navigation_entry_impl.cc -@@ -942,8 +942,9 @@ NavigationEntryImpl::ConstructCommitNavigationParams( - true /* origin_agent_cluster_left_as_default */, - std::vector< - network::mojom::WebClientHintsType>() /* enabled_client_hints */, -- false /* is_cross_browsing_instance */, nullptr /* old_page_info */, -- -1 /* http_response_code */, -+ false /* is_cross_site_cross_browsing_context_group */, -+ false /* should_have_sticky_user_activation */, -+ nullptr /* old_page_info */, -1 /* http_response_code */, - blink::mojom::NavigationApiHistoryEntryArrays::New(), - std::vector() /* early_hints_preloaded_resources */, - // This timestamp will be populated when the commit IPC is sent. -diff --git a/chromium/content/browser/renderer_host/navigation_request.cc b/chromium/content/browser/renderer_host/navigation_request.cc -index da6c714c0c04..923354bdafbf 100644 ---- src/3rdparty/chromium/content/browser/renderer_host/navigation_request.cc -+++ src/3rdparty/chromium/content/browser/renderer_host/navigation_request.cc -@@ -1318,7 +1318,8 @@ std::unique_ptr NavigationRequest::CreateRendererInitiated( - /*origin_agent_cluster_left_as_default=*/true, - /*enabled_client_hints=*/ - std::vector(), -- /*is_cross_browsing_instance=*/false, -+ /*is_cross_site_cross_browsing_context_group=*/false, -+ /*should_have_sticky_user_activation=*/false, - /*old_page_info=*/nullptr, /*http_response_code=*/-1, - blink::mojom::NavigationApiHistoryEntryArrays::New(), - /*early_hints_preloaded_resources=*/std::vector(), -@@ -1462,7 +1463,8 @@ NavigationRequest::CreateForSynchronousRendererCommit( - /*origin_agent_cluster_left_as_default=*/true, - /*enabled_client_hints=*/ - std::vector(), -- /*is_cross_browsing_instance=*/false, -+ /*is_cross_site_cross_browsing_context_group=*/false, -+ /*should_have_sticky_user_activation=*/false, - /*old_page_info=*/nullptr, http_response_code, - blink::mojom::NavigationApiHistoryEntryArrays::New(), - /*early_hints_preloaded_resources=*/std::vector(), -@@ -5599,11 +5601,11 @@ void NavigationRequest::CommitNavigation() { - } - } - -+ RenderFrameHostImpl* old_frame_host = -+ frame_tree_node_->render_manager()->current_frame_host(); - if (!NavigationTypeUtils::IsSameDocument(common_params_->navigation_type)) { - // We want to record this for the frame that we are navigating away from. -- frame_tree_node_->render_manager() -- ->current_frame_host() -- ->RecordNavigationSuddenTerminationHandlers(); -+ old_frame_host->RecordNavigationSuddenTerminationHandlers(); - } - if (IsServedFromBackForwardCache() || IsPrerenderedPageActivation()) { - CommitPageActivation(); -@@ -5623,8 +5625,7 @@ void NavigationRequest::CommitNavigation() { - if (!weak_self) - return; - -- DCHECK(GetRenderFrameHost() == -- frame_tree_node_->render_manager()->current_frame_host() || -+ DCHECK(GetRenderFrameHost() == old_frame_host || - GetRenderFrameHost() == - frame_tree_node_->render_manager()->speculative_frame_host()); - -@@ -5699,6 +5700,20 @@ void NavigationRequest::CommitNavigation() { - response(), frame_tree_node_); - } - -+ // Sticky user activation should only be preserved for same-site subframe -+ // navigations. This is done to prevent newly navigated documents from -+ // re-using the sticky user activation state from the previously navigated -+ // document in the frame. We persist user activation across same-site -+ // navigations for compatibility reasons, and this does not need to match the -+ // same-site checks used in the process model. See: crbug.com/736415. -+ // TODO(crbug.com/40228985): Remove this once we find a way to reset -+ // activation unconditionally without breaking sites in practice. -+ commit_params_->should_have_sticky_user_activation = -+ !frame_tree_node_->IsMainFrame() && -+ old_frame_host->HasStickyUserActivation() && -+ net::SchemefulSite(old_frame_host->GetLastCommittedOrigin()) == -+ net::SchemefulSite(origin); -+ - // Generate a UKM source and track it on NavigationRequest. This will be - // passed down to the blink::Document to be created, if any, and used for UKM - // source creation when navigation has successfully committed. -diff --git a/chromium/content/browser/renderer_host/navigator.cc b/chromium/content/browser/renderer_host/navigator.cc -index 1063f29af344..e4cdb82d5598 100644 ---- src/3rdparty/chromium/content/browser/renderer_host/navigator.cc -+++ src/3rdparty/chromium/content/browser/renderer_host/navigator.cc -@@ -47,6 +47,7 @@ - #include "content/public/common/content_constants.h" - #include "content/public/common/url_utils.h" - #include "net/base/net_errors.h" -+#include "net/base/schemeful_site.h" - #include "services/metrics/public/cpp/ukm_builders.h" - #include "services/metrics/public/cpp/ukm_recorder.h" - #include "services/metrics/public/cpp/ukm_source_id.h" -@@ -512,6 +513,9 @@ void Navigator::DidNavigate( - was_within_same_document); - } - -+ // Store this information before DidNavigateFrame() potentially swaps RFHs. -+ url::Origin old_frame_origin = old_frame_host->GetLastCommittedOrigin(); -+ - // DidNavigateFrame() must be called before replicating the new origin and - // other properties to proxies. This is because it destroys the subframes of - // the frame we're navigating from, which might trigger those subframes to -@@ -524,6 +528,29 @@ void Navigator::DidNavigate( - .ShouldClearProxiesOnCommit(), - navigation_request->commit_params().frame_policy); - -+ // The main frame, same site, and cross-site navigation checks for user -+ // activation mirror the checks in DocumentLoader::CommitNavigation() (note: -+ // CommitNavigation() is not called for same-document navigations, which is -+ // why we have the !was_within_same_document check). This is done to prevent -+ // newly navigated pages from re-using the sticky user activation state from -+ // the previously navigated page in the frame. We persist user activation -+ // across same-site navigations for compatibility reasons with user -+ // activation, and does not need to match the same-site checks used in the -+ // process model. See: crbug.com/736415, and crbug.com/40228985 for the -+ // specific regression that resulted in this requirement. -+ if (!was_within_same_document) { -+ if (!navigation_request->commit_params() -+ .should_have_sticky_user_activation) { -+ frame_tree_node->UpdateUserActivationState( -+ blink::mojom::UserActivationUpdateType::kClearActivation, -+ blink::mojom::UserActivationNotificationType::kNone); -+ } else { -+ frame_tree_node->UpdateUserActivationState( -+ blink::mojom::UserActivationUpdateType::kNotifyActivationStickyOnly, -+ blink::mojom::UserActivationNotificationType::kNone); -+ } -+ } -+ - // Save the new page's origin and other properties, and replicate them to - // proxies, including the proxy created in DidNavigateFrame() to replace the - // old frame in cross-process navigation cases. -@@ -534,12 +561,6 @@ void Navigator::DidNavigate( - render_frame_host->browsing_context_state()->SetInsecureNavigationsSet( - params.insecure_navigations_set); - -- if (!was_within_same_document) { -- // Navigating to a new location means a new, fresh set of http headers -- // and/or elements - we need to reset Permissions Policy. -- frame_tree_node->ResetForNavigation(); -- } -- - // If the committing URL requires the SiteInstance's site to be assigned, - // that site assignment should've already happened at ReadyToCommit time. We - // should never get here with a SiteInstance that doesn't have a site -diff --git a/chromium/content/browser/renderer_host/render_frame_host_impl.cc b/chromium/content/browser/renderer_host/render_frame_host_impl.cc -index c5f90d4965f9..d1d0efb398ba 100644 ---- src/3rdparty/chromium/content/browser/renderer_host/render_frame_host_impl.cc -+++ src/3rdparty/chromium/content/browser/renderer_host/render_frame_host_impl.cc -@@ -6002,9 +6002,14 @@ void RenderFrameHostImpl::ConsumeTransientUserActivation() { - } - - void RenderFrameHostImpl::ActivateUserActivation( -- blink::mojom::UserActivationNotificationType notification_type) { -- user_activation_state_.Activate(notification_type); -- history_user_activation_state_.Activate(); -+ blink::mojom::UserActivationNotificationType notification_type, -+ bool sticky_only) { -+ if (sticky_only) { -+ user_activation_state_.SetHasBeenActive(); -+ } else { -+ user_activation_state_.Activate(notification_type); -+ history_user_activation_state_.Activate(); -+ } - } - - void RenderFrameHostImpl::ActivateFocusSourceUserActivation() { -diff --git a/chromium/content/browser/renderer_host/render_frame_host_impl.h b/chromium/content/browser/renderer_host/render_frame_host_impl.h -index 378657c0a55d..0a001fb828e1 100644 ---- src/3rdparty/chromium/content/browser/renderer_host/render_frame_host_impl.h -+++ src/3rdparty/chromium/content/browser/renderer_host/render_frame_host_impl.h -@@ -2931,7 +2931,8 @@ class CONTENT_EXPORT RenderFrameHostImpl - void ClearUserActivation(); - void ConsumeTransientUserActivation(); - void ActivateUserActivation( -- blink::mojom::UserActivationNotificationType notification_type); -+ blink::mojom::UserActivationNotificationType notification_type, -+ bool sticky_only = false); - - // These are called only when RenderFrameHostOwner is iterating over all - // frames, not directly from the renderer. -diff --git a/chromium/content/renderer/render_frame_impl.cc b/chromium/content/renderer/render_frame_impl.cc -index 5da8ffc96764..13afea50ecba 100644 ---- src/3rdparty/chromium/content/renderer/render_frame_impl.cc -+++ src/3rdparty/chromium/content/renderer/render_frame_impl.cc -@@ -981,6 +981,9 @@ void FillMiscNavigationParams( - navigation_params->is_cross_site_cross_browsing_context_group = - commit_params.is_cross_site_cross_browsing_context_group; - -+ navigation_params->should_have_sticky_user_activation = -+ commit_params.should_have_sticky_user_activation; -+ - #if BUILDFLAG(IS_ANDROID) || defined(TOOLKIT_QT) - // Only android webview uses this. - navigation_params->grant_load_local_resources = -diff --git a/chromium/third_party/blink/common/frame/user_activation_state.cc b/chromium/third_party/blink/common/frame/user_activation_state.cc -index 5804fa8049be..ad85a074d10b 100644 ---- src/3rdparty/chromium/third_party/blink/common/frame/user_activation_state.cc -+++ src/3rdparty/chromium/third_party/blink/common/frame/user_activation_state.cc -@@ -47,6 +47,10 @@ void UserActivationState::Activate( - transient_state_expiry_time_for_interaction_ = transient_state_expiry_time_; - } - -+void UserActivationState::SetHasBeenActive() { -+ has_been_active_ = true; -+} -+ - void UserActivationState::Clear() { - has_been_active_ = false; - last_activation_was_restricted_ = false; -diff --git a/chromium/third_party/blink/public/common/frame/user_activation_state.h b/chromium/third_party/blink/public/common/frame/user_activation_state.h -index fe530372caa0..6e143d2e9795 100644 ---- src/3rdparty/chromium/third_party/blink/public/common/frame/user_activation_state.h -+++ src/3rdparty/chromium/third_party/blink/public/common/frame/user_activation_state.h -@@ -111,6 +111,10 @@ class BLINK_COMMON_EXPORT UserActivationState { - // |is_restricted| as a parameter here. - void Activate(mojom::UserActivationNotificationType notification_type); - -+ // Used when propagating user activation state across cross-process -+ // navigations. -+ void SetHasBeenActive(); -+ - void Clear(); - - // Returns the sticky activation state, which is |true| if the frame has ever -diff --git a/chromium/third_party/blink/public/mojom/frame/user_activation_update_types.mojom b/chromium/third_party/blink/public/mojom/frame/user_activation_update_types.mojom -index 6db97b4a695c..5acd66856df0 100644 ---- src/3rdparty/chromium/third_party/blink/public/mojom/frame/user_activation_update_types.mojom -+++ src/3rdparty/chromium/third_party/blink/public/mojom/frame/user_activation_update_types.mojom -@@ -7,8 +7,16 @@ module blink.mojom; - // Types of UserActivationV2 state updates sent between the browser and the - // renderer processes. - enum UserActivationUpdateType { -+ // Used to give a document sticky and transient user activation as a result of -+ // a user gesture. - kNotifyActivation, - kNotifyActivationPendingBrowserVerification, -+ // Used to propagate the sticky user activation state during cross-document -+ // navigations. -+ kNotifyActivationStickyOnly, -+ // Used after a sensitive API is called to prevent abuse of the API. - kConsumeTransientActivation, -+ // Used during cross-document navigations when the user activation state -+ // shouldn't be propagated. - kClearActivation - }; -diff --git a/chromium/third_party/blink/public/mojom/navigation/navigation_params.mojom b/chromium/third_party/blink/public/mojom/navigation/navigation_params.mojom -index b568f7442142..3947e8dcaeb3 100644 ---- src/3rdparty/chromium/third_party/blink/public/mojom/navigation/navigation_params.mojom -+++ src/3rdparty/chromium/third_party/blink/public/mojom/navigation/navigation_params.mojom -@@ -510,6 +510,10 @@ struct CommitNavigationParams { - // Whether this is a cross-site navigation that swaps BrowsingContextGroups. - bool is_cross_site_cross_browsing_context_group = false; - -+ // Whether the new document should start with sticky user activation, because -+ // the previously committed document did, and the navigation was same-site. -+ bool should_have_sticky_user_activation = false; -+ - // Should only be set to a valid value for main-frame same-site navigations - // where we did a proactive BrowsingInstance swap and we're reusing the old - // page's process. -diff --git a/chromium/third_party/blink/public/web/web_navigation_params.h b/chromium/third_party/blink/public/web/web_navigation_params.h -index 560c4e985497..206bff0b0042 100644 ---- src/3rdparty/chromium/third_party/blink/public/web/web_navigation_params.h -+++ src/3rdparty/chromium/third_party/blink/public/web/web_navigation_params.h -@@ -466,6 +466,10 @@ struct BLINK_EXPORT WebNavigationParams { - // (BrowsingInstances). - bool is_cross_site_cross_browsing_context_group = false; - -+ // Whether the new document should start with sticky user activation, because -+ // the previously committed document did, and the navigation was same-site. -+ bool should_have_sticky_user_activation = false; -+ - // Blink's copy of the policy container containing security policies to be - // enforced on the document created by this navigation. - std::unique_ptr policy_container; -diff --git a/chromium/third_party/blink/renderer/core/frame/frame.cc b/chromium/third_party/blink/renderer/core/frame/frame.cc -index e0ce2a1bcbef..ce18145c67a6 100644 ---- src/3rdparty/chromium/third_party/blink/renderer/core/frame/frame.cc -+++ src/3rdparty/chromium/third_party/blink/renderer/core/frame/frame.cc -@@ -286,10 +286,21 @@ void Frame::DidChangeVisibilityState() { - child_frames[i]->DidChangeVisibilityState(); - } - -+void Frame::NotifyUserActivationInFrameTreeStickyOnly() { -+ NotifyUserActivationInFrameTree( -+ mojom::blink::UserActivationNotificationType::kNone, -+ /*sticky_only=*/true); -+} -+ - void Frame::NotifyUserActivationInFrameTree( -- mojom::blink::UserActivationNotificationType notification_type) { -+ mojom::blink::UserActivationNotificationType notification_type, -+ bool sticky_only) { - for (Frame* node = this; node; node = node->Tree().Parent()) { -- node->user_activation_state_.Activate(notification_type); -+ if (sticky_only) { -+ node->user_activation_state_.SetHasBeenActive(); -+ } else { -+ node->user_activation_state_.Activate(notification_type); -+ } - node->ActivateHistoryUserActivationState(); - } - -@@ -307,7 +318,11 @@ void Frame::NotifyUserActivationInFrameTree( - if (local_frame_node && - security_origin->CanAccess( - local_frame_node->GetSecurityContext()->GetSecurityOrigin())) { -- node->user_activation_state_.Activate(notification_type); -+ if (sticky_only) { -+ node->user_activation_state_.SetHasBeenActive(); -+ } else { -+ node->user_activation_state_.Activate(notification_type); -+ } - node->ActivateHistoryUserActivationState(); - } - } -diff --git a/chromium/third_party/blink/renderer/core/frame/frame.h b/chromium/third_party/blink/renderer/core/frame/frame.h -index 2487e9a9a98a..3707cff0fa64 100644 ---- src/3rdparty/chromium/third_party/blink/renderer/core/frame/frame.h -+++ src/3rdparty/chromium/third_party/blink/renderer/core/frame/frame.h -@@ -256,6 +256,12 @@ class CORE_EXPORT Frame : public GarbageCollected { - return user_activation_state_.LastActivationWasRestricted(); - } - -+ // Sets the sticky user activation state of this frame. This does not change -+ // the transient user activation state. -+ void SetStickyUserActivationState() { -+ user_activation_state_.SetHasBeenActive(); -+ } -+ - // Resets the user activation state of this frame. - void ClearUserActivation() { user_activation_state_.Clear(); } - -@@ -482,8 +488,10 @@ class CORE_EXPORT Frame : public GarbageCollected { - void ApplyFrameOwnerProperties( - mojom::blink::FrameOwnerPropertiesPtr properties); - -+ void NotifyUserActivationInFrameTreeStickyOnly(); - void NotifyUserActivationInFrameTree( -- mojom::blink::UserActivationNotificationType notification_type); -+ mojom::blink::UserActivationNotificationType notification_type, -+ bool sticky_only = false); - bool ConsumeTransientUserActivationInFrameTree(); - void ClearUserActivationInFrameTree(); - -diff --git a/chromium/third_party/blink/renderer/core/frame/remote_frame.cc b/chromium/third_party/blink/renderer/core/frame/remote_frame.cc -index e5d0e24fa1cb..7f3f457261da 100644 ---- src/3rdparty/chromium/third_party/blink/renderer/core/frame/remote_frame.cc -+++ src/3rdparty/chromium/third_party/blink/renderer/core/frame/remote_frame.cc -@@ -665,6 +665,9 @@ void RemoteFrame::UpdateUserActivationState( - case mojom::blink::UserActivationUpdateType::kNotifyActivation: - NotifyUserActivationInFrameTree(notification_type); - break; -+ case mojom::blink::UserActivationUpdateType::kNotifyActivationStickyOnly: -+ NotifyUserActivationInFrameTreeStickyOnly(); -+ break; - case mojom::blink::UserActivationUpdateType::kConsumeTransientActivation: - ConsumeTransientUserActivationInFrameTree(); - break; -diff --git a/chromium/third_party/blink/renderer/core/loader/document_loader.cc b/chromium/third_party/blink/renderer/core/loader/document_loader.cc -index b7b130e869fe..b29ab01b9f84 100644 ---- src/3rdparty/chromium/third_party/blink/renderer/core/loader/document_loader.cc -+++ src/3rdparty/chromium/third_party/blink/renderer/core/loader/document_loader.cc -@@ -305,6 +305,7 @@ struct SameSizeAsDocumentLoader - bool origin_agent_cluster; - bool origin_agent_cluster_left_as_default; - bool is_cross_site_cross_browsing_context_group; -+ bool should_have_sticky_user_activation; - WebVector navigation_api_back_entries; - WebVector navigation_api_forward_entries; - std::unique_ptr code_cache_host; -@@ -512,6 +513,8 @@ DocumentLoader::DocumentLoader( - params_->origin_agent_cluster_left_as_default), - is_cross_site_cross_browsing_context_group_( - params_->is_cross_site_cross_browsing_context_group), -+ should_have_sticky_user_activation_( -+ params_->should_have_sticky_user_activation), - navigation_api_back_entries_(params_->navigation_api_back_entries), - navigation_api_forward_entries_(params_->navigation_api_forward_entries), - extra_data_(std::move(extra_data)), -@@ -651,6 +654,9 @@ DocumentLoader::CreateWebNavigationParamsToCloneDocument() { - params->document_ukm_source_id = ukm_source_id_; - params->is_cross_site_cross_browsing_context_group = - is_cross_site_cross_browsing_context_group_; -+ // Required for javascript: URL commits to propagate sticky user activation. -+ params->should_have_sticky_user_activation = -+ frame_->HasStickyUserActivation() && !frame_->IsMainFrame(); - params->has_text_fragment_token = has_text_fragment_token_; - // Origin trials must still work on the cloned document. - params->initiator_origin_trial_features = -@@ -2554,10 +2560,19 @@ void DocumentLoader::CommitNavigation() { - - frame_->ClearScrollSnapshotClients(); - -- // Clear the user activation state. -+ // Determine whether to give the frame sticky user activation. These checks -+ // mirror the check in Navigator::DidNavigate(). Main frame navigations and -+ // cross-site navigations should not hold on to the sticky user activation -+ // state of the previously navigated page. Same-site navigations should retain -+ // the previous document's sticky user activation state, regardless of whether -+ // the navigation resulted in a new process being created. -+ // See: crbug.com/41493458 - // TODO(crbug.com/736415): Clear this bit unconditionally for all frames. -- if (frame_->IsMainFrame()) -- frame_->ClearUserActivation(); -+ if (!should_have_sticky_user_activation_) { -+ frame_->ClearUserActivation(); -+ } else { -+ frame_->SetStickyUserActivationState(); -+ } - - // The DocumentLoader was flagged as activated if it needs to notify the frame - // that it was activated before navigation. Update the frame state based on -diff --git a/chromium/third_party/blink/renderer/core/loader/document_loader.h b/chromium/third_party/blink/renderer/core/loader/document_loader.h -index 1548bbee1845..ca1758eef3f4 100644 ---- src/3rdparty/chromium/third_party/blink/renderer/core/loader/document_loader.h -+++ src/3rdparty/chromium/third_party/blink/renderer/core/loader/document_loader.h -@@ -783,6 +783,10 @@ class CORE_EXPORT DocumentLoader : public GarbageCollected, - // BrowsingContextGroup. - bool is_cross_site_cross_browsing_context_group_ = false; - -+ // Whether the new document should start with sticky user activation, because -+ // the previously committed document did, and the navigation was same-site. -+ bool should_have_sticky_user_activation_ = false; -+ - WebVector navigation_api_back_entries_; - WebVector navigation_api_forward_entries_; - -From 6fd09d7a49f15e12264f25a54db9fe189b235d16 Mon Sep 17 00:00:00 2001 -From: Ayu Ishii -Date: Thu, 21 Mar 2024 20:06:29 +0000 -Subject: [PATCH] [Backport] Security bug 323898565 - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5288855: -WebSQL: Remove session data logic - -On Profile destruction, currently there is a race with -the DatabaseTracker shutdown. DatabaseTracker shutdown -will post task[1] on the database task runner because -it needs to do file I/O. However it also has some logic -to retrieve info for special storage policies from the -Profile which may already be destroyed by that time. - -This change removes logic for special storage policy from -DatabaseTracker. DatabaseTracker(WebSQL) is removed -from all platforms as of M119 except for WebView, which does -not utilize the special storage policy. All policy and -deprecation support have ended with M123. Therefore cleaning -up the code to avoid the race. - -[1]https://source.chromium.org/chromium/chromium/src/+/main:content/browser/storage_partition_impl.cc;l=1200;drc=be92f4cc2f137460213d52a926c9477275a456c5 - -Bug: 323898565, 325476286 -Change-Id: Ie2ef898c558308439a8b0d3fdf67f7157440b20a -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5288855 -Commit-Queue: Ayu Ishii -Reviewed-by: Alex Moshchuk -Reviewed-by: Evan Stade -Cr-Commit-Position: refs/heads/main@{#1276451} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/557063 -Reviewed-by: Michal Klocek ---- - chromium/content/browser/browser_context.cc | 8 --- - .../content/browser/storage_partition_impl.cc | 3 +- - .../browser/database/database_tracker.cc | 65 +------------------ - .../browser/database/database_tracker.h | 15 ----- - 4 files changed, 3 insertions(+), 88 deletions(-) - -diff --git a/chromium/content/browser/browser_context.cc b/chromium/content/browser/browser_context.cc -index c07c16f62e3..6b952d4572f 100644 ---- src/3rdparty/chromium/content/browser/browser_context.cc -+++ src/3rdparty/chromium/content/browser/browser_context.cc -@@ -56,7 +56,6 @@ - #include "media/mojo/services/video_decode_perf_history.h" - #include "media/mojo/services/webrtc_video_perf_history.h" - #include "storage/browser/blob/blob_storage_context.h" --#include "storage/browser/database/database_tracker.h" - #include "storage/browser/file_system/external_mount_points.h" - #include "third_party/blink/public/mojom/push_messaging/push_messaging.mojom.h" - #include "third_party/perfetto/include/perfetto/tracing/traced_proto.h" -@@ -252,13 +251,6 @@ void BrowserContext::EnsureResourceContextInitialized() { - void BrowserContext::SaveSessionState() { - StoragePartition* storage_partition = GetDefaultStoragePartition(); - -- storage::DatabaseTracker* database_tracker = -- storage_partition->GetDatabaseTracker(); -- database_tracker->task_runner()->PostTask( -- FROM_HERE, -- base::BindOnce(&storage::DatabaseTracker::SetForceKeepSessionState, -- base::WrapRefCounted(database_tracker))); -- - storage_partition->GetCookieManagerForBrowserProcess() - ->SetForceKeepSessionState(); - -diff --git a/chromium/content/browser/storage_partition_impl.cc b/chromium/content/browser/storage_partition_impl.cc -index 3147e6d0371..12ef04e2d8f 100644 ---- src/3rdparty/chromium/content/browser/storage_partition_impl.cc -+++ src/3rdparty/chromium/content/browser/storage_partition_impl.cc -@@ -1371,8 +1371,7 @@ void StoragePartitionImpl::Initialize( - browser_context_, partition_path_, is_in_memory(), quota_manager_proxy); - - database_tracker_ = storage::DatabaseTracker::Create( -- partition_path_, is_in_memory(), -- browser_context_->GetSpecialStoragePolicy(), quota_manager_proxy); -+ partition_path_, is_in_memory(), quota_manager_proxy); - - dom_storage_context_ = DOMStorageContextWrapper::Create( - this, browser_context_->GetSpecialStoragePolicy()); -diff --git a/chromium/storage/browser/database/database_tracker.cc b/chromium/storage/browser/database/database_tracker.cc -index 5dbfcf2d422..865661ea56e 100644 ---- src/3rdparty/chromium/storage/browser/database/database_tracker.cc -+++ src/3rdparty/chromium/storage/browser/database/database_tracker.cc -@@ -42,7 +42,6 @@ - #include "storage/browser/database/databases_table.h" - #include "storage/browser/quota/quota_client_type.h" - #include "storage/browser/quota/quota_manager_proxy.h" --#include "storage/browser/quota/special_storage_policy.h" - #include "storage/common/database/database_identifier.h" - #include "third_party/blink/public/common/storage_key/storage_key.h" - #include "third_party/blink/public/mojom/quota/quota_types.mojom.h" -@@ -73,12 +72,6 @@ OriginInfo::OriginInfo(const OriginInfo& origin_info) = default; - - OriginInfo::~OriginInfo() = default; - --void OriginInfo::GetAllDatabaseNames( -- std::vector* databases) const { -- for (const auto& name_and_size : database_sizes_) -- databases->push_back(name_and_size.first); --} -- - int64_t OriginInfo::GetDatabaseSize(const std::u16string& database_name) const { - auto it = database_sizes_.find(database_name); - if (it != database_sizes_.end()) -@@ -92,11 +85,10 @@ OriginInfo::OriginInfo(const std::string& origin_identifier, int64_t total_size) - scoped_refptr DatabaseTracker::Create( - const base::FilePath& profile_path, - bool is_incognito, -- scoped_refptr special_storage_policy, - scoped_refptr quota_manager_proxy) { - auto database_tracker = base::MakeRefCounted( -- profile_path, is_incognito, std::move(special_storage_policy), -- std::move(quota_manager_proxy), base::PassKey()); -+ profile_path, is_incognito, std::move(quota_manager_proxy), -+ base::PassKey()); - database_tracker->RegisterQuotaClient(); - return database_tracker; - } -@@ -104,7 +96,6 @@ scoped_refptr DatabaseTracker::Create( - DatabaseTracker::DatabaseTracker( - const base::FilePath& profile_path, - bool is_incognito, -- scoped_refptr special_storage_policy, - scoped_refptr quota_manager_proxy, - base::PassKey) - : is_incognito_(is_incognito), -@@ -117,7 +108,6 @@ DatabaseTracker::DatabaseTracker( - .page_size = 4096, - .cache_size = 500, - })), -- special_storage_policy_(std::move(special_storage_policy)), - quota_manager_proxy_(std::move(quota_manager_proxy)), - task_runner_(base::ThreadPool::CreateSequencedTaskRunner( - {base::MayBlock(), base::TaskPriority::USER_VISIBLE, -@@ -791,12 +781,6 @@ void DatabaseTracker::DeleteDataModifiedSince( - DatabaseSet to_be_deleted; - int rv = net::OK; - for (const auto& origin : origins_identifiers) { -- if (special_storage_policy_.get() && -- special_storage_policy_->IsStorageProtected( -- GetOriginURLFromIdentifier(origin))) { -- continue; -- } -- - std::vector details; - if (!databases_table_->GetAllDatabaseDetailsForOriginIdentifier(origin, - &details)) { -@@ -930,44 +914,6 @@ void DatabaseTracker::DeleteIncognitoDBDirectory() { - base::DeletePathRecursively(incognito_db_dir); - } - --void DatabaseTracker::ClearSessionOnlyOrigins() { -- DCHECK(task_runner_->RunsTasksInCurrentSequence()); -- bool has_session_only_databases = -- special_storage_policy_.get() && -- special_storage_policy_->HasSessionOnlyOrigins(); -- -- // Clearing only session-only databases, and there are none. -- if (!has_session_only_databases) -- return; -- -- if (!LazyInit()) -- return; -- -- std::vector origin_identifiers; -- GetAllOriginIdentifiers(&origin_identifiers); -- -- for (const auto& origin : origin_identifiers) { -- GURL origin_url = GetOriginURLFromIdentifier(origin); -- if (!special_storage_policy_->IsStorageSessionOnly(origin_url)) -- continue; -- if (special_storage_policy_->IsStorageProtected(origin_url)) -- continue; -- OriginInfo origin_info; -- std::vector databases; -- GetOriginInfo(origin, &origin_info); -- origin_info.GetAllDatabaseNames(&databases); -- -- for (const auto& database : databases) { -- base::File file( -- GetFullDBFilePath(origin, database), -- base::File::FLAG_OPEN_ALWAYS | base::File::FLAG_WIN_SHARE_DELETE | -- base::File::FLAG_DELETE_ON_CLOSE | base::File::FLAG_READ); -- } -- DeleteOrigin(origin, true); -- } --} -- -- - void DatabaseTracker::Shutdown() { - DCHECK(task_runner_->RunsTasksInCurrentSequence()); - if (shutting_down_) { -@@ -984,8 +930,6 @@ void DatabaseTracker::Shutdown() { - - if (is_incognito_) - DeleteIncognitoDBDirectory(); -- else if (!force_keep_session_state_) -- ClearSessionOnlyOrigins(); - CloseTrackerDatabaseAndClearCaches(); - - // Explicitly destroy `db_` on the correct sequence rather than waiting for -@@ -996,9 +940,4 @@ void DatabaseTracker::Shutdown() { - db_.reset(); - } - --void DatabaseTracker::SetForceKeepSessionState() { -- DCHECK(task_runner_->RunsTasksInCurrentSequence()); -- force_keep_session_state_ = true; --} -- - } // namespace storage -diff --git a/chromium/storage/browser/database/database_tracker.h b/chromium/storage/browser/database/database_tracker.h -index 57d189e338d..bc55a0b020a 100644 ---- src/3rdparty/chromium/storage/browser/database/database_tracker.h -+++ src/3rdparty/chromium/storage/browser/database/database_tracker.h -@@ -41,7 +41,6 @@ namespace storage { - class DatabaseQuotaClient; - class QuotaClientCallbackWrapper; - class QuotaManagerProxy; --class SpecialStoragePolicy; - - COMPONENT_EXPORT(STORAGE_BROWSER) - extern const base::FilePath::CharType kDatabaseDirectoryName[]; -@@ -101,13 +100,11 @@ class COMPONENT_EXPORT(STORAGE_BROWSER) DatabaseTracker - static scoped_refptr Create( - const base::FilePath& profile_path, - bool is_incognito, -- scoped_refptr special_storage_policy, - scoped_refptr quota_manager_proxy); - - // Exposed for base::MakeRefCounted. Users should call Create(). - DatabaseTracker(const base::FilePath& profile_path, - bool is_incognito, -- scoped_refptr special_storage_policy, - scoped_refptr quota_manager_proxy, - base::PassKey); - -@@ -168,9 +165,6 @@ class COMPONENT_EXPORT(STORAGE_BROWSER) DatabaseTracker - - // Deletes databases touched since `cutoff`. - // -- // Does not delete databases belonging to origins designated as protected by -- // the SpecialStoragePolicy passed to the DatabaseTracker constructor. -- // - // `callback` must must be non-null, and is invoked upon completion with a - // net::Error. The status will be net::OK on success, or net::FAILED if not - // all databases could be deleted. `callback` may be called before this method -@@ -198,8 +192,6 @@ class COMPONENT_EXPORT(STORAGE_BROWSER) DatabaseTracker - // Shutdown the database tracker, deleting database files if the tracker is - // used for an Incognito profile. - void Shutdown(); -- // Disables the exit-time deletion of session-only data. -- void SetForceKeepSessionState(); - - protected: - // Subclasses need PassKeys to call the constructor. -@@ -248,9 +240,6 @@ class COMPONENT_EXPORT(STORAGE_BROWSER) DatabaseTracker - // exists. - void DeleteIncognitoDBDirectory(); - -- // Deletes session-only databases. Blocks databases from being created/opened. -- void ClearSessionOnlyOrigins(); -- - bool DeleteClosedDatabase(const std::string& origin_identifier, - const std::u16string& database_name); - -@@ -303,7 +292,6 @@ class COMPONENT_EXPORT(STORAGE_BROWSER) DatabaseTracker - - bool is_initialized_ = false; - const bool is_incognito_; -- bool force_keep_session_state_ = false; - bool shutting_down_ = false; - const base::FilePath profile_path_; - -@@ -324,9 +312,6 @@ class COMPONENT_EXPORT(STORAGE_BROWSER) DatabaseTracker - std::vector> - deletion_callbacks_; - -- // Apps and Extensions can have special rights. -- const scoped_refptr special_storage_policy_; -- - // Can be accessed from any thread via quota_manager_proxy(). - // - // Thread-safety argument: The reference is immutable. -From 3ef0cdbadfc403513047464d18e63fc952a43f7b Mon Sep 17 00:00:00 2001 -From: Shahbaz Youssefi -Date: Mon, 8 Apr 2024 10:14:45 -0400 -Subject: [PATCH] [Backport] CVE-2024-4058: Type Confusion in ANGLE - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/angle/angle/+/5462388: -SPIR-V: Fix const constructors with single scalar - -These constructors may be generated because of -RemoveArrayLengthTraverser. - -Bug: chromium:332546345 -Change-Id: I2b2bf3728ef5bae148abc2a8518f8f3f42850025 -Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5462388 -(cherry picked from commit 0b776d32f69a932acb61963d9daad9e13f610944) -Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5466390 -Commit-Queue: Zakhar Voit -Reviewed-by: Shahbaz Youssefi -Reviewed-by: Geoff Lang -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/557315 -Reviewed-by: Allan Sandfeld Jensen ---- - .../third_party/angle/src/compiler/translator/Compiler.cpp | 5 +++++ - .../angle/src/compiler/translator/spirv/OutputSPIRV.cpp | 2 ++ - 2 files changed, 7 insertions(+) - -diff --git a/chromium/third_party/angle/src/compiler/translator/Compiler.cpp b/chromium/third_party/angle/src/compiler/translator/Compiler.cpp -index c70c419631a..c846c9b33fa 100644 ---- src/3rdparty/chromium/third_party/angle/src/compiler/translator/Compiler.cpp -+++ src/3rdparty/chromium/third_party/angle/src/compiler/translator/Compiler.cpp -@@ -1034,6 +1034,11 @@ bool TCompiler::checkAndSimplifyAST(TIntermBlock *root, - { - return false; - } -+ // Fold the expressions again, because |RemoveArrayLengthMethod| can introduce new constants. -+ if (!FoldExpressions(this, root, &mDiagnostics)) -+ { -+ return false; -+ } - - if (!RemoveUnreferencedVariables(this, root, &mSymbolTable)) - { -diff --git a/chromium/third_party/angle/src/compiler/translator/spirv/OutputSPIRV.cpp b/chromium/third_party/angle/src/compiler/translator/spirv/OutputSPIRV.cpp -index ed3aac4e432..4c3d1d000c6 100644 ---- src/3rdparty/chromium/third_party/angle/src/compiler/translator/spirv/OutputSPIRV.cpp -+++ src/3rdparty/chromium/third_party/angle/src/compiler/translator/spirv/OutputSPIRV.cpp -@@ -1335,6 +1335,8 @@ spirv::IdRef OutputSPIRVTraverser::createComplexConstant(const TType &type, - - if (type.isMatrix() && !type.isArray()) - { -+ ASSERT(parameters.size() == type.getRows() * type.getCols()); -+ - // Matrices are constructed from their columns. - spirv::IdRefList columnIds; - -From b0ff4b16e877e3787a7200b71440c9f2be7fe1d7 Mon Sep 17 00:00:00 2001 -From: Antonio Maiorano -Date: Thu, 18 Apr 2024 13:07:04 -0400 -Subject: [PATCH] [Backport] CVE-2024-4060: Use after free in Dawn - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/external/github.com/microsoft/DirectXShaderCompiler/+/5464347: -Replace dynamic_cast with virtual call (#6515) - -Make TextDiagnosticPrinter::setPrefix a virtual function in base class -DiagnosticConsumer. This allows us to avoid using dynamic_cast in -BackendConsumer::DxilDiagHandler, required for codebases that do not -enable RTTI. This is also the only place in the codebase that uses RTTI -(AFAICT). - -Bug: chromium:333420620 -Change-Id: Ida73077f24fdb4b705b5d868b04ac6cfecb30327 -Reviewed-on: https://chromium-review.googlesource.com/c/external/github.com/microsoft/DirectXShaderCompiler/+/5464347 -Reviewed-by: dan sinclair -Reviewed-by: David Neto -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/557316 -Reviewed-by: Allan Sandfeld Jensen ---- - .../dxc/tools/clang/include/clang/Basic/Diagnostic.h | 2 ++ - .../tools/clang/include/clang/Frontend/TextDiagnosticPrinter.h | 3 ++- - .../third_party/dxc/tools/clang/lib/CodeGen/CodeGenAction.cpp | 2 +- - 3 files changed, 5 insertions(+), 2 deletions(-) - -diff --git a/chromium/third_party/dawn/third_party/dxc/tools/clang/include/clang/Basic/Diagnostic.h b/chromium/third_party/dawn/third_party/dxc/tools/clang/include/clang/Basic/Diagnostic.h -index cf56e3a7208..b6f804012c5 100644 ---- src/3rdparty/chromium/third_party/dawn/third_party/dxc/tools/clang/include/clang/Basic/Diagnostic.h -+++ src/3rdparty/chromium/third_party/dawn/third_party/dxc/tools/clang/include/clang/Basic/Diagnostic.h -@@ -1395,6 +1395,8 @@ class DiagnosticConsumer { - /// warnings and errors. - virtual void HandleDiagnostic(DiagnosticsEngine::Level DiagLevel, - const Diagnostic &Info); -+ -+ virtual void setPrefix(std::string Value) {} // HLSL Change - }; - - /// \brief A diagnostic client that ignores all diagnostics. -diff --git a/chromium/third_party/dawn/third_party/dxc/tools/clang/include/clang/Frontend/TextDiagnosticPrinter.h b/chromium/third_party/dawn/third_party/dxc/tools/clang/include/clang/Frontend/TextDiagnosticPrinter.h -index 04a570559fe..936031e0967 100644 ---- src/3rdparty/chromium/third_party/dawn/third_party/dxc/tools/clang/include/clang/Frontend/TextDiagnosticPrinter.h -+++ src/3rdparty/chromium/third_party/dawn/third_party/dxc/tools/clang/include/clang/Frontend/TextDiagnosticPrinter.h -@@ -45,7 +45,8 @@ class TextDiagnosticPrinter : public DiagnosticConsumer { - /// setPrefix - Set the diagnostic printer prefix string, which will be - /// printed at the start of any diagnostics. If empty, no prefix string is - /// used. -- void setPrefix(std::string Value) { Prefix = Value; } -+ // HLSL Change: add override -+ void setPrefix(std::string Value) override { Prefix = Value; } - - void BeginSourceFile(const LangOptions &LO, const Preprocessor *PP) override; - void EndSourceFile() override; -diff --git a/chromium/third_party/dawn/third_party/dxc/tools/clang/lib/CodeGen/CodeGenAction.cpp b/chromium/third_party/dawn/third_party/dxc/tools/clang/lib/CodeGen/CodeGenAction.cpp -index 4fa721e8122..68ebaadf5a8 100644 ---- src/3rdparty/chromium/third_party/dawn/third_party/dxc/tools/clang/lib/CodeGen/CodeGenAction.cpp -+++ src/3rdparty/chromium/third_party/dawn/third_party/dxc/tools/clang/lib/CodeGen/CodeGenAction.cpp -@@ -557,7 +557,7 @@ BackendConsumer::DxilDiagHandler(const llvm::DiagnosticInfoDxil &D) { - - // If no location information is available, add function name - if (Loc.isInvalid()) { -- auto *DiagClient = dynamic_cast(Diags.getClient()); -+ auto *DiagClient = Diags.getClient(); - auto *func = D.getFunction(); - if (DiagClient && func) - DiagClient->setPrefix("Function: " + func->getName().str()); -From b916ca00cc5222253ac5860c3e612ccf00d899c3 Mon Sep 17 00:00:00 2001 -From: Nina Satragno -Date: Mon, 8 Apr 2024 20:07:43 +0000 -Subject: [PATCH] [Backport] Security bug 332724843 - -Partial manual backport of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5426374: -[webauthn] Don't keep network contexts around - -Instead of having fido code pass network contexts around, pass a factory -and get a fresh one every time one is needed. - -Keep cable transact* methods that take a network context around until -we clean up the android cable client module in a follow-up. - -Bug: 332724843 -Change-Id: I33ea5c741706041c75c10cf881452fcf77fce445 -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5426374 -Reviewed-by: Adam Langley -Commit-Queue: Nina Satragno -Cr-Commit-Position: refs/heads/main@{#1284063} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/557317 -Reviewed-by: Allan Sandfeld Jensen ---- - chromium/device/fido/BUILD.gn | 1 + - .../device/fido/cable/fido_tunnel_device.cc | 9 +-- - .../device/fido/cable/fido_tunnel_device.h | 5 +- - .../device/fido/cable/v2_authenticator.cc | 66 +++++++++++++++---- - chromium/device/fido/cable/v2_authenticator.h | 28 +++++++- - chromium/device/fido/cable/v2_discovery.cc | 10 +-- - chromium/device/fido/cable/v2_discovery.h | 5 +- - .../device/fido/fido_discovery_factory.cc | 7 +- - chromium/device/fido/fido_discovery_factory.h | 8 ++- - .../device/fido/network_context_factory.h | 20 ++++++ - 10 files changed, 122 insertions(+), 37 deletions(-) - create mode 100644 chromium/device/fido/network_context_factory.h - -diff --git a/chromium/device/fido/BUILD.gn b/chromium/device/fido/BUILD.gn -index 8e168df02ef..be11e40a4ce 100644 ---- src/3rdparty/chromium/device/fido/BUILD.gn -+++ src/3rdparty/chromium/device/fido/BUILD.gn -@@ -42,6 +42,7 @@ component("fido") { - "fido_transport_protocol.h", - "json_request.cc", - "json_request.h", -+ "network_context_factory.h", - "opaque_attestation_statement.cc", - "opaque_attestation_statement.h", - "p256_public_key.cc", -diff --git a/chromium/device/fido/cable/fido_tunnel_device.cc b/chromium/device/fido/cable/fido_tunnel_device.cc -index ad35e6ee176..bd10a4793bb 100644 ---- src/3rdparty/chromium/device/fido/cable/fido_tunnel_device.cc -+++ src/3rdparty/chromium/device/fido/cable/fido_tunnel_device.cc -@@ -17,6 +17,7 @@ - #include "device/fido/features.h" - #include "device/fido/fido_constants.h" - #include "device/fido/fido_parsing_utils.h" -+#include "device/fido/network_context_factory.h" - #include "net/traffic_annotation/network_traffic_annotation.h" - #include "third_party/boringssl/src/include/openssl/aes.h" - #include "third_party/boringssl/src/include/openssl/digest.h" -@@ -96,7 +97,7 @@ constexpr net::NetworkTrafficAnnotationTag kTrafficAnnotation = - })"); - - FidoTunnelDevice::FidoTunnelDevice( -- network::mojom::NetworkContext* network_context, -+ NetworkContextFactory network_context_factory, - absl::optional)>> - pairing_callback, - absl::optional> event_callback, -@@ -130,7 +131,7 @@ FidoTunnelDevice::FidoTunnelDevice( - base::BindOnce(&FidoTunnelDevice::OnTunnelReady, base::Unretained(this)), - base::BindRepeating(&FidoTunnelDevice::OnTunnelData, - base::Unretained(this))); -- network_context->CreateWebSocket( -+ network_context_factory.Run()->CreateWebSocket( - url, {kCableWebSocketProtocol}, net::SiteForCookies(), - net::IsolationInfo(), /*additional_headers=*/{}, - network::mojom::kBrowserProcessId, url::Origin::Create(url), -@@ -145,7 +146,7 @@ FidoTunnelDevice::FidoTunnelDevice( - - FidoTunnelDevice::FidoTunnelDevice( - FidoRequestType request_type, -- network::mojom::NetworkContext* network_context, -+ NetworkContextFactory network_context_factory, - std::unique_ptr pairing, - base::OnceClosure pairing_is_invalid, - absl::optional> event_callback) -@@ -187,7 +188,7 @@ FidoTunnelDevice::FidoTunnelDevice( - headers.emplace_back( - network::mojom::HttpHeader::New(kCableSignalConnectionHeader, "true")); - } -- network_context->CreateWebSocket( -+ network_context_factory.Run()->CreateWebSocket( - url, {kCableWebSocketProtocol}, net::SiteForCookies(), - net::IsolationInfo(), std::move(headers), - network::mojom::kBrowserProcessId, url::Origin::Create(url), -diff --git a/chromium/device/fido/cable/fido_tunnel_device.h b/chromium/device/fido/cable/fido_tunnel_device.h -index 1d0a7cb3372..840ecc34232 100644 ---- src/3rdparty/chromium/device/fido/cable/fido_tunnel_device.h -+++ src/3rdparty/chromium/device/fido/cable/fido_tunnel_device.h -@@ -17,6 +17,7 @@ - #include "device/fido/cable/websocket_adapter.h" - #include "device/fido/fido_constants.h" - #include "device/fido/fido_device.h" -+#include "device/fido/network_context_factory.h" - #include "third_party/abseil-cpp/absl/types/variant.h" - - namespace network::mojom { -@@ -33,7 +34,7 @@ class COMPONENT_EXPORT(DEVICE_FIDO) FidoTunnelDevice : public FidoDevice { - public: - // This constructor is used for QR-initiated connections. - FidoTunnelDevice( -- network::mojom::NetworkContext* network_context, -+ NetworkContextFactory network_context_factory, - absl::optional)>> - pairing_callback, - absl::optional> event_callback, -@@ -47,7 +48,7 @@ class COMPONENT_EXPORT(DEVICE_FIDO) FidoTunnelDevice : public FidoDevice { - // run. - FidoTunnelDevice( - FidoRequestType request_type, -- network::mojom::NetworkContext* network_context, -+ NetworkContextFactory network_context_factory, - std::unique_ptr pairing, - base::OnceClosure pairing_is_invalid, - absl::optional> event_callback); -diff --git a/chromium/device/fido/cable/v2_authenticator.cc b/chromium/device/fido/cable/v2_authenticator.cc -index e4bd3244cb3..faf8915ec10 100644 ---- src/3rdparty/chromium/device/fido/cable/v2_authenticator.cc -+++ src/3rdparty/chromium/device/fido/cable/v2_authenticator.cc -@@ -23,6 +23,7 @@ - #include "device/fido/features.h" - #include "device/fido/fido_constants.h" - #include "device/fido/fido_parsing_utils.h" -+#include "device/fido/network_context_factory.h" - #include "device/fido/public_key_credential_descriptor.h" - #include "device/fido/public_key_credential_params.h" - #include "device/fido/public_key_credential_rp_entity.h" -@@ -289,7 +290,7 @@ class TunnelTransport : public Transport { - public: - TunnelTransport( - Platform* platform, -- network::mojom::NetworkContext* network_context, -+ NetworkContextFactory network_context_factory, - base::span secret, - base::span peer_identity, - GeneratePairingDataCallback generate_pairing_data) -@@ -302,7 +303,7 @@ class TunnelTransport : public Transport { - secret, - base::span(), - device::cablev2::DerivedValueType::kEIDKey)), -- network_context_(network_context), -+ network_context_factory_(std::move(network_context_factory)), - peer_identity_(device::fido_parsing_utils::Materialize(peer_identity)), - generate_pairing_data_(std::move(generate_pairing_data)), - secret_(fido_parsing_utils::Materialize(secret)) { -@@ -319,7 +320,7 @@ class TunnelTransport : public Transport { - - TunnelTransport( - Platform* platform, -- network::mojom::NetworkContext* network_context, -+ NetworkContextFactory network_context_factory, - base::span secret, - base::span client_nonce, - std::array routing_id, -@@ -331,7 +332,7 @@ class TunnelTransport : public Transport { - secret, - client_nonce, - device::cablev2::DerivedValueType::kEIDKey)), -- network_context_(network_context), -+ network_context_factory_(network_context_factory), - secret_(fido_parsing_utils::Materialize(secret)), - local_identity_(std::move(local_identity)) { - DCHECK_EQ(state_, State::kNone); -@@ -390,7 +391,7 @@ class TunnelTransport : public Transport { - void StartWebSocket() { - DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_); - -- network_context_->CreateWebSocket( -+ network_context_factory_.Run()->CreateWebSocket( - target_, {device::kCableWebSocketProtocol}, net::SiteForCookies(), - net::IsolationInfo(), /*additional_headers=*/{}, - network::mojom::kBrowserProcessId, url::Origin::Create(target_), -@@ -623,7 +624,7 @@ class TunnelTransport : public Transport { - const std::array eid_key_; - std::unique_ptr websocket_client_; - std::unique_ptr crypter_; -- const raw_ptr network_context_; -+ NetworkContextFactory network_context_factory_; - const absl::optional> peer_identity_; - std::array psk_; - GeneratePairingDataCallback generate_pairing_data_; -@@ -1238,7 +1239,7 @@ std::unique_ptr TransactWithPlaintextTransport( - - std::unique_ptr TransactFromQRCode( - std::unique_ptr platform, -- network::mojom::NetworkContext* network_context, -+ NetworkContextFactory network_context_factory, - base::span root_secret, - const std::string& authenticator_name, - base::span qr_secret, -@@ -1249,16 +1250,34 @@ std::unique_ptr TransactFromQRCode( - - Platform* const platform_ptr = platform.get(); - return std::make_unique( -- std::make_unique(platform_ptr, network_context, -- qr_secret, peer_identity, -- std::move(generate_pairing_data)), -+ std::make_unique( -+ platform_ptr, std::move(network_context_factory), qr_secret, -+ peer_identity, std::move(generate_pairing_data)), - std::move(platform)); - } - --std::unique_ptr TransactFromFCM( -+std::unique_ptr TransactFromQRCodeDeprecated( - std::unique_ptr platform, - network::mojom::NetworkContext* network_context, - base::span root_secret, -+ const std::string& authenticator_name, -+ base::span qr_secret, -+ base::span peer_identity, -+ std::optional> contact_id) { -+ NetworkContextFactory factory = base::BindRepeating( -+ [](network::mojom::NetworkContext* network_context) { -+ return network_context; -+ }, -+ network_context); -+ return TransactFromQRCode(std::move(platform), std::move(factory), -+ root_secret, authenticator_name, qr_secret, -+ peer_identity, std::move(contact_id)); -+} -+ -+std::unique_ptr TransactFromFCM( -+ std::unique_ptr platform, -+ NetworkContextFactory network_context_factory, -+ base::span root_secret, - std::array routing_id, - base::span tunnel_id, - base::span pairing_id, -@@ -1269,12 +1288,31 @@ std::unique_ptr TransactFromFCM( - - Platform* const platform_ptr = platform.get(); - return std::make_unique( -- std::make_unique(platform_ptr, network_context, -- paired_secret, client_nonce, routing_id, -- tunnel_id, IdentityKey(root_secret)), -+ std::make_unique( -+ platform_ptr, std::move(network_context_factory), paired_secret, -+ client_nonce, routing_id, tunnel_id, IdentityKey(root_secret)), - std::move(platform)); - } - -+std::unique_ptr TransactFromFCMDeprecated( -+ std::unique_ptr platform, -+ network::mojom::NetworkContext* network_context, -+ base::span root_secret, -+ std::array routing_id, -+ base::span tunnel_id, -+ base::span pairing_id, -+ base::span client_nonce, -+ std::optional> contact_id) { -+ NetworkContextFactory factory = base::BindRepeating( -+ [](network::mojom::NetworkContext* network_context) { -+ return network_context; -+ }, -+ network_context); -+ return TransactFromFCM(std::move(platform), std::move(factory), root_secret, -+ std::move(routing_id), tunnel_id, pairing_id, -+ client_nonce, std::move(contact_id)); -+} -+ - } // namespace authenticator - } // namespace cablev2 - } // namespace device -diff --git a/chromium/device/fido/cable/v2_authenticator.h b/chromium/device/fido/cable/v2_authenticator.h -index 0f55d7758ed..811e632e915 100644 ---- src/3rdparty/chromium/device/fido/cable/v2_authenticator.h -+++ src/3rdparty/chromium/device/fido/cable/v2_authenticator.h -@@ -14,6 +14,7 @@ - #include "base/functional/callback.h" - #include "device/fido/cable/v2_constants.h" - #include "device/fido/fido_constants.h" -+#include "device/fido/network_context_factory.h" - #include "services/network/public/mojom/network_context.mojom-forward.h" - #include "third_party/abseil-cpp/absl/types/optional.h" - #include "third_party/abseil-cpp/absl/types/variant.h" -@@ -139,7 +140,7 @@ std::unique_ptr TransactWithPlaintextTransport( - // contents of a QR code. - std::unique_ptr TransactFromQRCode( - std::unique_ptr platform, -- network::mojom::NetworkContext* network_context, -+ NetworkContextFactory network_context_factory, - base::span root_secret, - const std::string& authenticator_name, - // TODO: name this constant. -@@ -147,11 +148,22 @@ std::unique_ptr TransactFromQRCode( - base::span peer_identity, - absl::optional> contact_id); - -+// Deprecated, kept around while Android cable code is cleaned up. Use -+// TransactFromQRCode instead. -+std::unique_ptr TransactFromQRCodeDeprecated( -+ std::unique_ptr platform, -+ network::mojom::NetworkContext* network_context, -+ base::span root_secret, -+ const std::string& authenticator_name, -+ base::span qr_secret, -+ base::span peer_identity, -+ std::optional> contact_id); -+ - // TransactFromFCM starts a network-based transaction based on the decoded - // contents of a cloud message. - std::unique_ptr TransactFromFCM( - std::unique_ptr platform, -- network::mojom::NetworkContext* network_context, -+ NetworkContextFactory network_context_factory, - base::span root_secret, - std::array routing_id, - base::span tunnel_id, -@@ -159,6 +171,18 @@ std::unique_ptr TransactFromFCM( - base::span client_nonce, - absl::optional> contact_id); - -+// Deprecated, kept around while Android cable code is cleaned up. Use -+// TransactFromFCM instead. -+std::unique_ptr TransactFromFCMDeprecated( -+ std::unique_ptr platform, -+ network::mojom::NetworkContext* network_context, -+ base::span root_secret, -+ std::array routing_id, -+ base::span tunnel_id, -+ base::span pairing_id, -+ base::span client_nonce, -+ std::optional> contact_id); -+ - } // namespace authenticator - } // namespace cablev2 - } // namespace device -diff --git a/chromium/device/fido/cable/v2_discovery.cc b/chromium/device/fido/cable/v2_discovery.cc -index e6a8bb03557..c19ed148ee1 100644 ---- src/3rdparty/chromium/device/fido/cable/v2_discovery.cc -+++ src/3rdparty/chromium/device/fido/cable/v2_discovery.cc -@@ -49,7 +49,7 @@ void RecordEvent(CableV2DiscoveryEvent event) { - - Discovery::Discovery( - FidoRequestType request_type, -- network::mojom::NetworkContext* network_context, -+ NetworkContextFactory network_context_factory, - absl::optional> qr_generator_key, - std::unique_ptr advert_stream, - std::unique_ptr>> -@@ -62,7 +62,7 @@ Discovery::Discovery( - absl::optional> event_callback) - : FidoDeviceDiscovery(FidoTransportProtocol::kHybrid), - request_type_(request_type), -- network_context_(network_context), -+ network_context_factory_(std::move(network_context_factory)), - qr_keys_(KeysFromQRGeneratorKey(qr_generator_key)), - extension_keys_(KeysFromExtension(extension_contents)), - advert_stream_(std::move(advert_stream)), -@@ -161,7 +161,7 @@ void Discovery::OnBLEAdvertSeen(base::span advert) { - event_callback_->Run(Event::kBLEAdvertReceived); - } - AddDevice(std::make_unique( -- network_context_, pairing_callback_, event_callback_, -+ network_context_factory_, pairing_callback_, event_callback_, - qr_keys_->qr_secret, qr_keys_->local_identity_seed, *plaintext)); - return; - } -@@ -177,7 +177,7 @@ void Discovery::OnBLEAdvertSeen(base::span advert) { - RecordEvent(CableV2DiscoveryEvent::kExtensionMatch); - device_committed_ = true; - AddDevice(std::make_unique( -- network_context_, base::DoNothing(), event_callback_, -+ network_context_factory_, base::DoNothing(), event_callback_, - extension.qr_secret, extension.local_identity_seed, *plaintext)); - return; - } -@@ -190,7 +190,7 @@ void Discovery::OnBLEAdvertSeen(base::span advert) { - void Discovery::OnContactDevice(std::unique_ptr pairing) { - auto pairing_copy = std::make_unique(*pairing); - tunnels_pending_advert_.emplace_back(std::make_unique( -- request_type_, network_context_, std::move(pairing), -+ request_type_, network_context_factory_, std::move(pairing), - base::BindOnce(&Discovery::PairingIsInvalid, weak_factory_.GetWeakPtr(), - std::move(pairing_copy)), - event_callback_)); -diff --git a/chromium/device/fido/cable/v2_discovery.h b/chromium/device/fido/cable/v2_discovery.h -index c5aa2179d7b..44fc0180c58 100644 ---- src/3rdparty/chromium/device/fido/cable/v2_discovery.h -+++ src/3rdparty/chromium/device/fido/cable/v2_discovery.h -@@ -19,6 +19,7 @@ - #include "device/fido/cable/v2_constants.h" - #include "device/fido/fido_constants.h" - #include "device/fido/fido_device_discovery.h" -+#include "device/fido/network_context_factory.h" - #include "services/network/public/mojom/network_context.mojom-forward.h" - #include "third_party/abseil-cpp/absl/types/optional.h" - -@@ -36,7 +37,7 @@ class COMPONENT_EXPORT(DEVICE_FIDO) Discovery : public FidoDeviceDiscovery { - - Discovery( - FidoRequestType request_type, -- network::mojom::NetworkContext* network_context, -+ NetworkContextFactory network_context_factory, - absl::optional> qr_generator_key, - std::unique_ptr advert_stream, - // contact_device_stream contains a series of pairings indicating that the -@@ -80,7 +81,7 @@ class COMPONENT_EXPORT(DEVICE_FIDO) Discovery : public FidoDeviceDiscovery { - const std::vector& extension_contents); - - const FidoRequestType request_type_; -- const raw_ptr network_context_; -+ NetworkContextFactory network_context_factory_; - const absl::optional qr_keys_; - const std::vector extension_keys_; - std::unique_ptr advert_stream_; -diff --git a/chromium/device/fido/fido_discovery_factory.cc b/chromium/device/fido/fido_discovery_factory.cc -index 040aa19fbb4..2d6c85c7721 100644 ---- src/3rdparty/chromium/device/fido/fido_discovery_factory.cc -+++ src/3rdparty/chromium/device/fido/fido_discovery_factory.cc -@@ -87,7 +87,7 @@ std::vector> FidoDiscoveryFactory::Create( - &CableDiscoveryData::version); - if (qr_generator_key_.has_value() || have_v2_discovery_data) { - ret.emplace_back(std::make_unique( -- request_type_.value(), network_context_, qr_generator_key_, -+ request_type_.value(), network_context_factory_, qr_generator_key_, - v1_discovery->GetV2AdvertStream(), - std::move(contact_device_stream_), - cable_data_.value_or(std::vector()), -@@ -148,11 +148,6 @@ void FidoDiscoveryFactory::set_android_accessory_params( - aoa_request_description_ = std::move(aoa_request_description); - } - --void FidoDiscoveryFactory::set_network_context( -- network::mojom::NetworkContext* network_context) { -- network_context_ = network_context; --} -- - void FidoDiscoveryFactory::set_cable_pairing_callback( - base::RepeatingCallback)> callback) { - cable_pairing_callback_ = std::move(callback); -diff --git a/chromium/device/fido/fido_discovery_factory.h b/chromium/device/fido/fido_discovery_factory.h -index ed2b51d86cc..9705d548c24 100644 ---- src/3rdparty/chromium/device/fido/fido_discovery_factory.h -+++ src/3rdparty/chromium/device/fido/fido_discovery_factory.h -@@ -22,6 +22,7 @@ - #include "device/fido/fido_request_handler_base.h" - #include "device/fido/fido_transport_protocol.h" - #include "device/fido/hid/fido_hid_discovery.h" -+#include "device/fido/network_context_factory.h" - #include "mojo/public/cpp/bindings/remote.h" - #include "services/device/public/mojom/usb_manager.mojom.h" - #include "services/network/public/mojom/network_context.mojom-forward.h" -@@ -69,7 +70,10 @@ class COMPONENT_EXPORT(DEVICE_FIDO) FidoDiscoveryFactory { - mojo::Remote, - std::string aoa_request_description); - -- void set_network_context(network::mojom::NetworkContext*); -+ void set_network_context_factory( -+ NetworkContextFactory network_context_factory) { -+ network_context_factory_ = std::move(network_context_factory); -+ } - - // set_cable_pairing_callback installs a repeating callback that will be - // called when a QR handshake results in a phone wishing to pair with this -@@ -167,7 +171,7 @@ class COMPONENT_EXPORT(DEVICE_FIDO) FidoDiscoveryFactory { - absl::optional> - usb_device_manager_; - std::string aoa_request_description_; -- raw_ptr network_context_ = nullptr; -+ NetworkContextFactory network_context_factory_; - absl::optional> cable_data_; - absl::optional> qr_generator_key_; - absl::optional request_type_; -diff --git a/chromium/device/fido/network_context_factory.h b/chromium/device/fido/network_context_factory.h -new file mode 100644 -index 00000000000..802f45c4c45 ---- /dev/null -+++ src/3rdparty/chromium/device/fido/network_context_factory.h -@@ -0,0 +1,20 @@ -+// Copyright 2024 The Chromium Authors -+// Use of this source code is governed by a BSD-style license that can be -+// found in the LICENSE file. -+ -+#ifndef DEVICE_FIDO_NETWORK_CONTEXT_FACTORY_H_ -+#define DEVICE_FIDO_NETWORK_CONTEXT_FACTORY_H_ -+ -+#include "base/functional/callback_forward.h" -+ -+namespace network::mojom { -+class NetworkContext; -+} // namespace network::mojom -+ -+namespace device { -+using NetworkContextFactory = -+ base::RepeatingCallback; -+} // namespace device -+ -+#endif // DEVICE_FIDO_NETWORK_CONTEXT_FACTORY_H_ -+ -From 533465116ce3b87ebd30d1b4de055daa413c1050 Mon Sep 17 00:00:00 2001 -From: Tommy Steimel -Date: Wed, 24 Apr 2024 09:18:49 +0000 -Subject: [PATCH] [Backport] CVE-2024-4331: Use after free in Picture In - Picture - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5477908: -Don't assume the enter event window is a LocalDOMWindow - -This CL changes DocumentPictureInPictureEvent to store a DOMWindow -instead of a LocalDOMWindow to prevent crashes when the window it gets -is actually a RemoteDOMWindow. - -(cherry picked from commit 2314741cdf2c4a6e11234dda7006ec0dd9005bbb) - -Bug: 335003891 -Change-Id: I86a0ec5a89b51a26d5dd89559f86e6e4d6c3e8fe -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5467978 -Commit-Queue: Tommy Steimel -Cr-Original-Commit-Position: refs/heads/main@{#1290122} -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5477908 -Auto-Submit: Tommy Steimel -Commit-Queue: Frank Liberato -Cr-Commit-Position: refs/branch-heads/6367@{#974} -Cr-Branched-From: d158c6dc6e3604e6f899041972edf26087a49740-refs/heads/main@{#1274542} -(cherry picked from commit 98bcf9ef5cdd3a19f8b739f2cc6b2afdb01b7694) -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/560756 -Reviewed-by: Allan Sandfeld Jensen ---- - .../document_picture_in_picture_event.cc | 9 ++++----- - .../document_picture_in_picture_event.h | 11 +++++------ - 2 files changed, 9 insertions(+), 11 deletions(-) - -diff --git a/chromium/third_party/blink/renderer/modules/document_picture_in_picture/document_picture_in_picture_event.cc b/chromium/third_party/blink/renderer/modules/document_picture_in_picture/document_picture_in_picture_event.cc -index 037813c62c2..572d0803c25 100644 ---- src/3rdparty/chromium/third_party/blink/renderer/modules/document_picture_in_picture/document_picture_in_picture_event.cc -+++ src/3rdparty/chromium/third_party/blink/renderer/modules/document_picture_in_picture/document_picture_in_picture_event.cc -@@ -8,7 +8,7 @@ namespace blink { - - DocumentPictureInPictureEvent* DocumentPictureInPictureEvent::Create( - const AtomicString& type, -- LocalDOMWindow* document_picture_in_picture_window) { -+ DOMWindow* document_picture_in_picture_window) { - return MakeGarbageCollected( - type, document_picture_in_picture_window); - } -@@ -19,13 +19,13 @@ DocumentPictureInPictureEvent* DocumentPictureInPictureEvent::Create( - return MakeGarbageCollected(type, initializer); - } - --LocalDOMWindow* DocumentPictureInPictureEvent::window() const { -+DOMWindow* DocumentPictureInPictureEvent::window() const { - return document_picture_in_picture_window_.Get(); - } - - DocumentPictureInPictureEvent::DocumentPictureInPictureEvent( - AtomicString const& type, -- LocalDOMWindow* document_picture_in_picture_window) -+ DOMWindow* document_picture_in_picture_window) - : Event(type, Bubbles::kYes, Cancelable::kNo), - document_picture_in_picture_window_(document_picture_in_picture_window) {} - -@@ -33,8 +33,7 @@ DocumentPictureInPictureEvent::DocumentPictureInPictureEvent( - AtomicString const& type, - const DocumentPictureInPictureEventInit* initializer) - : Event(type, initializer), -- document_picture_in_picture_window_( -- static_cast(initializer->window())) {} -+ document_picture_in_picture_window_(initializer->window()) {} - - void DocumentPictureInPictureEvent::Trace(Visitor* visitor) const { - visitor->Trace(document_picture_in_picture_window_); -diff --git a/chromium/third_party/blink/renderer/modules/document_picture_in_picture/document_picture_in_picture_event.h b/chromium/third_party/blink/renderer/modules/document_picture_in_picture/document_picture_in_picture_event.h -index 7af20221469..59cd8cb7a2e 100644 ---- src/3rdparty/chromium/third_party/blink/renderer/modules/document_picture_in_picture/document_picture_in_picture_event.h -+++ src/3rdparty/chromium/third_party/blink/renderer/modules/document_picture_in_picture/document_picture_in_picture_event.h -@@ -6,7 +6,7 @@ - #define THIRD_PARTY_BLINK_RENDERER_MODULES_DOCUMENT_PICTURE_IN_PICTURE_DOCUMENT_PICTURE_IN_PICTURE_EVENT_H_ - - #include "third_party/blink/renderer/bindings/modules/v8/v8_document_picture_in_picture_event_init.h" --#include "third_party/blink/renderer/core/frame/local_dom_window.h" -+#include "third_party/blink/renderer/core/frame/dom_window.h" - #include "third_party/blink/renderer/modules/event_modules.h" - #include "third_party/blink/renderer/platform/wtf/text/atomic_string.h" - -@@ -18,22 +18,21 @@ class MODULES_EXPORT DocumentPictureInPictureEvent final : public Event { - DEFINE_WRAPPERTYPEINFO(); - - public: -- static DocumentPictureInPictureEvent* Create(const AtomicString&, -- LocalDOMWindow*); -+ static DocumentPictureInPictureEvent* Create(const AtomicString&, DOMWindow*); - static DocumentPictureInPictureEvent* Create( - const AtomicString&, - const DocumentPictureInPictureEventInit*); - -- DocumentPictureInPictureEvent(AtomicString const&, LocalDOMWindow*); -+ DocumentPictureInPictureEvent(AtomicString const&, DOMWindow*); - DocumentPictureInPictureEvent(AtomicString const&, - const DocumentPictureInPictureEventInit*); - -- LocalDOMWindow* window() const; -+ DOMWindow* window() const; - - void Trace(Visitor*) const override; - - private: -- Member document_picture_in_picture_window_; -+ Member document_picture_in_picture_window_; - }; - - } // namespace blink -From 8f952f1e9d4fbfcfa23f8970985214f473ebffed Mon Sep 17 00:00:00 2001 -From: Antonio Maiorano -Date: Thu, 25 Apr 2024 16:49:11 -0400 -Subject: [PATCH] [Backport] CVE-2024-4368: Use after free in Dawn - -Manual cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/external/github.com/microsoft/DirectXShaderCompiler/+/5490380: -Fixed crash in loop unroll caused by bug in structurize loop exits (#6548) - -Fixed a bug in `hlsl::RemoveUnstructuredLoopExits` where when a new -exiting block is created from splitting, it was added to the current -loop being processed, when it could also part of an inner loop. Not -adding the new block to inner loops that it's part of makes the inner -loops malformed, and causes crash. - -This fix adds the new block to the inner most loop that it should be -part of. Also adds the `StructurizeLoopExits` option to `loop-unroll` -pass, which was missing before. - -Bug: chromium:333508731 -Change-Id: I7efc21bc61aeb81b4906a600c35272af232710ea -Reviewed-on: https://chromium-review.googlesource.com/c/external/github.com/microsoft/DirectXShaderCompiler/+/5490380 -Reviewed-by: James Price -Reviewed-by: Ben Clayton -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/560757 -Reviewed-by: Allan Sandfeld Jensen ---- - .../Scalar/DxilRemoveUnstructuredLoopExits.cpp | 7 ++++++- - .../dxc/lib/Transforms/Scalar/LoopUnrollPass.cpp | 12 ++++++++++++ - .../dawn/third_party/dxc/utils/hct/hctdb.py | 3 ++- - 3 files changed, 20 insertions(+), 2 deletions(-) - -diff --git a/chromium/third_party/dawn/third_party/dxc/lib/Transforms/Scalar/DxilRemoveUnstructuredLoopExits.cpp b/chromium/third_party/dawn/third_party/dxc/lib/Transforms/Scalar/DxilRemoveUnstructuredLoopExits.cpp -index 1278b1cac0a..a68a4dd7c56 100644 ---- src/3rdparty/chromium/third_party/dawn/third_party/dxc/lib/Transforms/Scalar/DxilRemoveUnstructuredLoopExits.cpp -+++ src/3rdparty/chromium/third_party/dawn/third_party/dxc/lib/Transforms/Scalar/DxilRemoveUnstructuredLoopExits.cpp -@@ -430,7 +430,12 @@ static bool RemoveUnstructuredLoopExitsIteration(BasicBlock *exiting_block, Loop - BasicBlock *new_not_exiting_block = new_exiting_block->splitBasicBlock(new_exiting_block->getFirstNonPHI()); - new_exiting_block->setName("dx.struct_exit.new_exiting"); - new_not_exiting_block->setName(old_name); -- L->addBasicBlockToLoop(new_not_exiting_block, *LI); -+ // Query for new_exiting_block's own loop to add new_not_exiting_block to. -+ // It's possible that new_exiting_block is part of another inner loop -+ // separate from L. If added directly to L, the inner loop(s) will not -+ // contain new_not_exiting_block, making them malformed. -+ Loop *inner_loop_of_exiting_block = LI->getLoopFor(new_exiting_block); -+ inner_loop_of_exiting_block->addBasicBlockToLoop(new_not_exiting_block, *LI); - - // Branch to latch_exit - new_exiting_block->getTerminator()->eraseFromParent(); -diff --git a/chromium/third_party/dawn/third_party/dxc/lib/Transforms/Scalar/LoopUnrollPass.cpp b/chromium/third_party/dawn/third_party/dxc/lib/Transforms/Scalar/LoopUnrollPass.cpp -index dd520f7e57d..b17a5a4a0bc 100644 ---- src/3rdparty/chromium/third_party/dawn/third_party/dxc/lib/Transforms/Scalar/LoopUnrollPass.cpp -+++ src/3rdparty/chromium/third_party/dawn/third_party/dxc/lib/Transforms/Scalar/LoopUnrollPass.cpp -@@ -155,6 +155,18 @@ namespace { - bool UserAllowPartial; - bool UserRuntime; - -+ // HLSL Change - begin -+ // Function overrides that resolve options when used for DxOpt -+ void applyOptions(PassOptions O) override { -+ GetPassOptionBool(O, "StructurizeLoopExits", &StructurizeLoopExits, -+ false); -+ } -+ void dumpConfig(raw_ostream &OS) override { -+ LoopPass::dumpConfig(OS); -+ OS << ",StructurizeLoopExits=" << StructurizeLoopExits; -+ } -+ // HLSL Change - end -+ - bool runOnLoop(Loop *L, LPPassManager &LPM) override; - - /// This transformation requires natural loop information & requires that -diff --git a/chromium/third_party/dawn/third_party/dxc/utils/hct/hctdb.py b/chromium/third_party/dawn/third_party/dxc/utils/hct/hctdb.py -index dcb1923fafe..96da518d1ac 100644 ---- src/3rdparty/chromium/third_party/dawn/third_party/dxc/utils/hct/hctdb.py -+++ src/3rdparty/chromium/third_party/dawn/third_party/dxc/utils/hct/hctdb.py -@@ -2270,7 +2270,8 @@ def add_pass(name, type_name, doc, opts): - {'n':'unroll-count', 'i':'UnrollCount', 't':'unsigned', 'd':'Use this unroll count for all loops including those with unroll_count pragma values, for testing purposes'}, - {'n':'unroll-allow-partial', 'i':'UnrollAllowPartial', 't':'bool', 'd':'Allows loops to be partially unrolled until -unroll-threshold loop size is reached.'}, - {'n':'unroll-runtime', 'i':'UnrollRuntime', 't':'bool', 'd':'Unroll loops with run-time trip counts'}, -- {'n':'pragma-unroll-threshold', 'i':'PragmaUnrollThreshold', 't':'unsigned', 'd':'Unrolled size limit for loops with an unroll(full) or unroll_count pragma.'}]) -+ {'n':'pragma-unroll-threshold', 'i':'PragmaUnrollThreshold', 't':'unsigned', 'd':'Unrolled size limit for loops with an unroll(full) or unroll_count pragma.'}, -+ {'n': 'StructurizeLoopExits', 't': 'bool', 'c': 1, 'd': 'Whether the unroller should try to structurize loop exits first.'}]) - add_pass('mldst-motion', 'MergedLoadStoreMotion', 'MergedLoadStoreMotion', []) - add_pass('gvn', 'GVN', 'Global Value Numbering', [ - {'n':'noloads', 't':'bool', 'c':1}, -From 453dc7630d1e8457a97a7cbc70b8990afd5bf5e4 Mon Sep 17 00:00:00 2001 -From: Ken Rockot -Date: Wed, 8 May 2024 15:32:48 +0000 -Subject: [PATCH] [Backport] CVE-2024-4671: Use after free in Visuals - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/chromium/src/+/5523748: -Viz: Tolerate SinkGroup destruction during submit - -Fixed: 339266700 -Change-Id: I8c0ea8c540948016346b00db64fe33260d2446f0 -Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5523748 -Reviewed-by: Kyle Charbonneau -Reviewed-by: Jonathan Ross -Commit-Queue: Ken Rockot -Cr-Commit-Position: refs/heads/main@{#1298119} -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/560758 -Reviewed-by: Allan Sandfeld Jensen ---- - .../frame_sinks/frame_sink_bundle_impl.cc | 30 ++++++++++++++----- - 1 file changed, 22 insertions(+), 8 deletions(-) - -diff --git a/chromium/components/viz/service/frame_sinks/frame_sink_bundle_impl.cc b/chromium/components/viz/service/frame_sinks/frame_sink_bundle_impl.cc -index e339c23f9cd..2ae2dfe1a8b 100644 ---- src/3rdparty/chromium/components/viz/service/frame_sinks/frame_sink_bundle_impl.cc -+++ src/3rdparty/chromium/components/viz/service/frame_sinks/frame_sink_bundle_impl.cc -@@ -4,12 +4,15 @@ - - #include "components/viz/service/frame_sinks/frame_sink_bundle_impl.h" - -+#include - #include - #include - - #include "base/check.h" - #include "base/functional/bind.h" -+#include "base/memory/raw_ptr.h" - #include "base/memory/raw_ref.h" -+#include "base/memory/weak_ptr.h" - #include "build/build_config.h" - #include "components/viz/service/frame_sinks/compositor_frame_sink_impl.h" - #include "components/viz/service/frame_sinks/frame_sink_manager_impl.h" -@@ -45,6 +48,10 @@ class FrameSinkBundleImpl::SinkGroup : public BeginFrameObserver { - - bool IsEmpty() const { return frame_sinks_.empty(); } - -+ base::WeakPtr GetWeakPtr() { -+ return weak_ptr_factory_.GetWeakPtr(); -+ } -+ - void AddFrameSink(uint32_t sink_id) { - frame_sinks_.insert(sink_id); - -@@ -206,6 +213,8 @@ class FrameSinkBundleImpl::SinkGroup : public BeginFrameObserver { - std::set unacked_submissions_; - - BeginFrameArgs last_used_begin_frame_args_; -+ -+ base::WeakPtrFactory weak_ptr_factory_{this}; - }; - - FrameSinkBundleImpl::FrameSinkBundleImpl( -@@ -276,8 +285,9 @@ void FrameSinkBundleImpl::SetNeedsBeginFrame(uint32_t sink_id, - - void FrameSinkBundleImpl::Submit( - std::vector submissions) { -- std::set groups; -- std::set affected_groups; -+ std::map, base::WeakPtr> groups; -+ std::map, base::WeakPtr> affected_groups; -+ - // Count the frame submissions before processing anything. This ensures that - // any frames submitted here will be acked together in a batch, and not acked - // individually in case they happen to ack synchronously within -@@ -288,10 +298,10 @@ void FrameSinkBundleImpl::Submit( - // through to the client without batching. - for (auto& submission : submissions) { - if (auto* group = GetSinkGroup(submission->sink_id)) { -- groups.insert(group); -+ groups.emplace(group, group->GetWeakPtr()); - if (submission->data->is_frame()) { - group->WillSubmitFrame(submission->sink_id); -- affected_groups.insert(group); -+ affected_groups.emplace(group, group->GetWeakPtr()); - } - } - } -@@ -321,12 +331,16 @@ void FrameSinkBundleImpl::Submit( - } - } - -- for (auto* group : groups) { -- group->DidFinishFrame(); -+ for (const auto& [unsafe_group, weak_group] : groups) { -+ if (weak_group) { -+ weak_group->DidFinishFrame(); -+ } - } - -- for (auto* group : affected_groups) { -- group->FlushMessages(); -+ for (const auto& [unsafe_group, weak_group] : affected_groups) { -+ if (weak_group) { -+ weak_group->FlushMessages(); -+ } - } - } - -From 09a04a46a47e57bc423cc37fb95bc66041936940 Mon Sep 17 00:00:00 2001 -From: Shu-yu Guo -Date: Thu, 9 May 2024 12:03:28 -0700 -Subject: [PATCH] [Backport] Security bug 339458194 - -Cherry-pick of patch originally reviewed on -https://chromium-review.googlesource.com/c/v8/v8/+/5527397 -Only normalize JSObject targets in SetOrCopyDataProperties - -Bug: b/339458194 -Change-Id: I4d6eebdd921971fa28d7c474535d978900ba633f -Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5527397 -Commit-Queue: Shu-yu Guo -Cr-Commit-Position: refs/heads/main@{#93811} -(cherry picked from commit f320600cd1f48ba6bb57c0395823fe0c5e5ec52e) -Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/560760 -Reviewed-by: Allan Sandfeld Jensen ---- - chromium/v8/src/objects/js-objects.cc | 4 +--- - 1 file changed, 1 insertion(+), 3 deletions(-) - -diff --git a/chromium/v8/src/objects/js-objects.cc b/chromium/v8/src/objects/js-objects.cc -index 6094323ee09..9d104492603 100644 ---- src/3rdparty/chromium/v8/src/objects/js-objects.cc -+++ src/3rdparty/chromium/v8/src/objects/js-objects.cc -@@ -429,9 +429,7 @@ Maybe JSReceiver::SetOrCopyDataProperties( - Nothing()); - - if (!from->HasFastProperties() && target->HasFastProperties() && -- !IsJSGlobalProxy(*target)) { -- // JSProxy is always in slow-mode. -- DCHECK(!IsJSProxy(*target)); -+ IsJSObject(*target) && !IsJSGlobalProxy(*target)) { - // Convert to slow properties if we're guaranteed to overflow the number of - // descriptors. - int source_length; diff --git a/www/qt6-webengine/files/patch-src_3rdparty_chromium_media_audio_sndio_sndio__input.cc b/www/qt6-webengine/files/patch-src_3rdparty_chromium_media_audio_sndio_sndio__input.cc index aebbac4f7a18..f6da297f1cb2 100644 --- a/www/qt6-webengine/files/patch-src_3rdparty_chromium_media_audio_sndio_sndio__input.cc +++ b/www/qt6-webengine/files/patch-src_3rdparty_chromium_media_audio_sndio_sndio__input.cc @@ -13,7 +13,7 @@ + +namespace media { + -+static const SampleFormat kSampleFormat = kSampleFormatS16; ++static const SampleFormat kSampleFormatAI = kSampleFormatS16; + +void SndioAudioInputStream::OnMoveCallback(void *arg, int delta) +{ @@ -59,7 +59,7 @@ + sio_initpar(&par); + par.rate = params.sample_rate(); + par.rchan = params.channels(); -+ par.bits = SampleFormatToBitsPerChannel(kSampleFormat); ++ par.bits = SampleFormatToBitsPerChannel(kSampleFormatAI); + par.bps = par.bits / 8; + par.sig = sig = par.bits != 8 ? 1 : 0; + par.le = SIO_LE_NATIVE; @@ -79,7 +79,7 @@ + + if (par.rate != (unsigned int)params.sample_rate() || + par.rchan != (unsigned int)params.channels() || -+ par.bits != (unsigned int)SampleFormatToBitsPerChannel(kSampleFormat) || ++ par.bits != (unsigned int)SampleFormatToBitsPerChannel(kSampleFormatAI) || + par.sig != (unsigned int)sig || + (par.bps > 1 && par.le != SIO_LE_NATIVE) || + (par.bits != par.bps * 8)) { @@ -87,7 +87,7 @@ + goto bad_close; + } + state = kStopped; -+ buffer = new char[audio_bus->frames() * params.GetBytesPerFrame(kSampleFormat)]; ++ buffer = new char[audio_bus->frames() * params.GetBytesPerFrame(kSampleFormatAI)]; + sio_onmove(hdl, &OnMoveCallback, this); + return OpenOutcome::kSuccess; +bad_close: @@ -176,7 +176,7 @@ + GetAgcVolume(&normalized_volume); + + // read one block -+ todo = nframes * params.GetBytesPerFrame(kSampleFormat); ++ todo = nframes * params.GetBytesPerFrame(kSampleFormatAI); + data = buffer; + while (todo > 0) { + n = sio_read(hdl, data, todo); diff --git a/www/qt6-webengine/files/patch-src_3rdparty_chromium_media_audio_sndio_sndio__output.cc b/www/qt6-webengine/files/patch-src_3rdparty_chromium_media_audio_sndio_sndio__output.cc index 5ee661707307..363cb11cbb93 100644 --- a/www/qt6-webengine/files/patch-src_3rdparty_chromium_media_audio_sndio_sndio__output.cc +++ b/www/qt6-webengine/files/patch-src_3rdparty_chromium_media_audio_sndio_sndio__output.cc @@ -14,7 +14,7 @@ + +namespace media { + -+static const SampleFormat kSampleFormat = kSampleFormatS16; ++static const SampleFormat kSampleFormatAO = kSampleFormatS16; + +void SndioAudioOutputStream::OnMoveCallback(void *arg, int delta) { + SndioAudioOutputStream* self = static_cast(arg); @@ -58,7 +58,7 @@ + state = kStopped; + volpending = 0; + vol = SIO_MAXVOL; -+ buffer = new char[audio_bus->frames() * params.GetBytesPerFrame(kSampleFormat)]; ++ buffer = new char[audio_bus->frames() * params.GetBytesPerFrame(kSampleFormatAO)]; + return true; +} + @@ -80,7 +80,7 @@ + sio_initpar(&par); + par.rate = params.sample_rate(); + par.pchan = params.channels(); -+ par.bits = SampleFormatToBitsPerChannel(kSampleFormat); ++ par.bits = SampleFormatToBitsPerChannel(kSampleFormatAO); + par.bps = par.bits / 8; + par.sig = sig = par.bits != 8 ? 1 : 0; + par.le = SIO_LE_NATIVE; @@ -98,7 +98,7 @@ + } + if (par.rate != (unsigned int)params.sample_rate() || + par.pchan != (unsigned int)params.channels() || -+ par.bits != (unsigned int)SampleFormatToBitsPerChannel(kSampleFormat) || ++ par.bits != (unsigned int)SampleFormatToBitsPerChannel(kSampleFormatAO) || + par.sig != (unsigned int)sig || + (par.bps > 1 && par.le != SIO_LE_NATIVE) || + (par.bits != par.bps * 8)) { @@ -170,12 +170,12 @@ + if (count == 0) { + // We have to submit something to the device + count = audio_bus->frames(); -+ memset(buffer, 0, count * params.GetBytesPerFrame(kSampleFormat)); ++ memset(buffer, 0, count * params.GetBytesPerFrame(kSampleFormatAO)); + LOG(WARNING) << "No data to play, running empty cycle."; + } + + // Submit data to the device -+ avail = count * params.GetBytesPerFrame(kSampleFormat); ++ avail = count * params.GetBytesPerFrame(kSampleFormatAO); + result = sio_write(hdl, buffer, avail); + if (result == 0) { + LOG(WARNING) << "Audio device disconnected."; diff --git a/www/qt6-webengine/files/patch-src_3rdparty_chromium_third__party_webrtc_pc_legacy__stats__collector.cc b/www/qt6-webengine/files/patch-src_3rdparty_chromium_third__party_webrtc_pc_legacy__stats__collector.cc deleted file mode 100644 index d2078c74e315..000000000000 --- a/www/qt6-webengine/files/patch-src_3rdparty_chromium_third__party_webrtc_pc_legacy__stats__collector.cc +++ /dev/null @@ -1,114 +0,0 @@ -commit 267f9bdd53a37d1cbee760d5af07880198e1beef -Author: Tommi -Date: 2023-12-21T14:08:26+01:00 - - Update LegacyStatsCollector to conform with Wc++11-narrowing - - Bug: none - Change-Id: Ida6a1af5c324473a55ea4f3b143862ea016ff50a - Reviewed-on: https://webrtc-review.googlesource.com/c/src/+/332240 - Commit-Queue: Tomas Gunnarsson - Reviewed-by: Harald Alvestrand - Auto-Submit: Tomas Gunnarsson - Reviewed-by: Alexander Kornienko - Reviewed-by: Henrik Boström - Cr-Commit-Position: refs/heads/main@{#41432} - ---- src/3rdparty/chromium/third_party/webrtc/pc/legacy_stats_collector.cc.orig 2024-02-10 00:27:53 UTC -+++ src/3rdparty/chromium/third_party/webrtc/pc/legacy_stats_collector.cc -@@ -188,9 +188,10 @@ void ExtractStats(const cricket::VoiceReceiverInfo& in - {StatsReport::kStatsValueNameAccelerateRate, info.accelerate_rate}, - {StatsReport::kStatsValueNamePreemptiveExpandRate, - info.preemptive_expand_rate}, -- {StatsReport::kStatsValueNameTotalAudioEnergy, info.total_output_energy}, -+ {StatsReport::kStatsValueNameTotalAudioEnergy, -+ static_cast(info.total_output_energy)}, - {StatsReport::kStatsValueNameTotalSamplesDuration, -- info.total_output_duration}}; -+ static_cast(info.total_output_duration)}}; - - const IntForAdd ints[] = { - {StatsReport::kStatsValueNameCurrentDelayMs, info.delay_estimate_ms}, -@@ -244,9 +245,10 @@ void ExtractStats(const cricket::VoiceSenderInfo& info - SetAudioProcessingStats(report, info.apm_statistics); - - const FloatForAdd floats[] = { -- {StatsReport::kStatsValueNameTotalAudioEnergy, info.total_input_energy}, -+ {StatsReport::kStatsValueNameTotalAudioEnergy, -+ static_cast(info.total_input_energy)}, - {StatsReport::kStatsValueNameTotalSamplesDuration, -- info.total_input_duration}}; -+ static_cast(info.total_input_duration)}}; - - RTC_DCHECK_GE(info.audio_level, 0); - const IntForAdd ints[] = { -@@ -340,7 +342,8 @@ void ExtractStats(const cricket::VideoReceiverInfo& in - {StatsReport::kStatsValueNamePlisSent, info.plis_sent}, - {StatsReport::kStatsValueNameRenderDelayMs, info.render_delay_ms}, - {StatsReport::kStatsValueNameTargetDelayMs, info.target_delay_ms}, -- {StatsReport::kStatsValueNameFramesDecoded, info.frames_decoded}, -+ {StatsReport::kStatsValueNameFramesDecoded, -+ static_cast(info.frames_decoded)}, - }; - - for (const auto& i : ints) -@@ -384,15 +387,19 @@ void ExtractStats(const cricket::VideoSenderInfo& info - info.encode_usage_percent}, - {StatsReport::kStatsValueNameFirsReceived, info.firs_received}, - {StatsReport::kStatsValueNameFrameHeightSent, info.send_frame_height}, -- {StatsReport::kStatsValueNameFrameRateInput, round(info.framerate_input)}, -+ {StatsReport::kStatsValueNameFrameRateInput, -+ static_cast(round(info.framerate_input))}, - {StatsReport::kStatsValueNameFrameRateSent, info.framerate_sent}, - {StatsReport::kStatsValueNameFrameWidthSent, info.send_frame_width}, -- {StatsReport::kStatsValueNameNacksReceived, info.nacks_received}, -+ {StatsReport::kStatsValueNameNacksReceived, -+ static_cast(info.nacks_received)}, - {StatsReport::kStatsValueNamePacketsLost, info.packets_lost}, - {StatsReport::kStatsValueNamePacketsSent, info.packets_sent}, - {StatsReport::kStatsValueNamePlisReceived, info.plis_received}, -- {StatsReport::kStatsValueNameFramesEncoded, info.frames_encoded}, -- {StatsReport::kStatsValueNameHugeFramesSent, info.huge_frames_sent}, -+ {StatsReport::kStatsValueNameFramesEncoded, -+ static_cast(info.frames_encoded)}, -+ {StatsReport::kStatsValueNameHugeFramesSent, -+ static_cast(info.huge_frames_sent)}, - }; - - for (const auto& i : ints) -@@ -780,19 +787,25 @@ StatsReport* LegacyStatsCollector::AddConnectionInfoRe - AddCandidateReport(remote_candidate_stats, false)->id()); - - const Int64ForAdd int64s[] = { -- {StatsReport::kStatsValueNameBytesReceived, info.recv_total_bytes}, -- {StatsReport::kStatsValueNameBytesSent, info.sent_total_bytes}, -- {StatsReport::kStatsValueNamePacketsSent, info.sent_total_packets}, -- {StatsReport::kStatsValueNameRtt, info.rtt}, -+ {StatsReport::kStatsValueNameBytesReceived, -+ static_cast(info.recv_total_bytes)}, -+ {StatsReport::kStatsValueNameBytesSent, -+ static_cast(info.sent_total_bytes)}, -+ {StatsReport::kStatsValueNamePacketsSent, -+ static_cast(info.sent_total_packets)}, -+ {StatsReport::kStatsValueNameRtt, static_cast(info.rtt)}, - {StatsReport::kStatsValueNameSendPacketsDiscarded, -- info.sent_discarded_packets}, -+ static_cast(info.sent_discarded_packets)}, - {StatsReport::kStatsValueNameSentPingRequestsTotal, -- info.sent_ping_requests_total}, -+ static_cast(info.sent_ping_requests_total)}, - {StatsReport::kStatsValueNameSentPingRequestsBeforeFirstResponse, -- info.sent_ping_requests_before_first_response}, -- {StatsReport::kStatsValueNameSentPingResponses, info.sent_ping_responses}, -- {StatsReport::kStatsValueNameRecvPingRequests, info.recv_ping_requests}, -- {StatsReport::kStatsValueNameRecvPingResponses, info.recv_ping_responses}, -+ static_cast(info.sent_ping_requests_before_first_response)}, -+ {StatsReport::kStatsValueNameSentPingResponses, -+ static_cast(info.sent_ping_responses)}, -+ {StatsReport::kStatsValueNameRecvPingRequests, -+ static_cast(info.recv_ping_requests)}, -+ {StatsReport::kStatsValueNameRecvPingResponses, -+ static_cast(info.recv_ping_responses)}, - }; - for (const auto& i : int64s) - report->AddInt64(i.name, i.value); diff --git a/www/qt6-websockets/distinfo b/www/qt6-websockets/distinfo index 4f6c0c4014f0..60670970a69d 100644 --- a/www/qt6-websockets/distinfo +++ b/www/qt6-websockets/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712115502 -SHA256 (KDE/Qt/6.7.0/qtwebsockets-everywhere-src-6.7.0.tar.xz) = 5ffc77da6b36cdf18e04c975a0fbf243968806a93a6291bcd2e9cd0b26139736 -SIZE (KDE/Qt/6.7.0/qtwebsockets-everywhere-src-6.7.0.tar.xz) = 454868 +TIMESTAMP = 1716400785 +SHA256 (KDE/Qt/6.7.1/qtwebsockets-everywhere-src-6.7.1.tar.xz) = fe16a6e4d2b819c72a56f671c5c697bae4c7f9fee4df2a4473b14caf7602feeb +SIZE (KDE/Qt/6.7.1/qtwebsockets-everywhere-src-6.7.1.tar.xz) = 459720 diff --git a/www/qt6-webview/distinfo b/www/qt6-webview/distinfo index bc7daf5619a4..9e369c769b30 100644 --- a/www/qt6-webview/distinfo +++ b/www/qt6-webview/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712115504 -SHA256 (KDE/Qt/6.7.0/qtwebview-everywhere-src-6.7.0.tar.xz) = 3619e07138cc1fe2fa091e25ba6548f5f11f26f1ebf68a56f193aed336ea5cf9 -SIZE (KDE/Qt/6.7.0/qtwebview-everywhere-src-6.7.0.tar.xz) = 138160 +TIMESTAMP = 1716400787 +SHA256 (KDE/Qt/6.7.1/qtwebview-everywhere-src-6.7.1.tar.xz) = 64ce8f1b3e3734d6b1ca3a5a0c93b209b34e46e4fcd333c6e702f5dd076c906b +SIZE (KDE/Qt/6.7.1/qtwebview-everywhere-src-6.7.1.tar.xz) = 138776 diff --git a/x11-toolkits/qt6-charts/distinfo b/x11-toolkits/qt6-charts/distinfo index 7faac41b1c9c..5b767223acf2 100644 --- a/x11-toolkits/qt6-charts/distinfo +++ b/x11-toolkits/qt6-charts/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712115516 -SHA256 (KDE/Qt/6.7.0/qtcharts-everywhere-src-6.7.0.tar.xz) = 899d5498c91bfb01fde2ff2438c82adf4d4d9b3cf646e7ad7b0036dbf32b7ca4 -SIZE (KDE/Qt/6.7.0/qtcharts-everywhere-src-6.7.0.tar.xz) = 4660736 +TIMESTAMP = 1716400793 +SHA256 (KDE/Qt/6.7.1/qtcharts-everywhere-src-6.7.1.tar.xz) = c236875ab3c812f0d59bad81a783095ae50932c7bea23cb81cd55437083d5d8c +SIZE (KDE/Qt/6.7.1/qtcharts-everywhere-src-6.7.1.tar.xz) = 4661252 diff --git a/x11-toolkits/qt6-datavis3d/distinfo b/x11-toolkits/qt6-datavis3d/distinfo index 1593b92d2681..d6a7c4dc6880 100644 --- a/x11-toolkits/qt6-datavis3d/distinfo +++ b/x11-toolkits/qt6-datavis3d/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712115524 -SHA256 (KDE/Qt/6.7.0/qtdatavis3d-everywhere-src-6.7.0.tar.xz) = 5a93248d1893790c5630fcbf7ba8394b7eb62411e4a80aa54d7ba8bd40091ba9 -SIZE (KDE/Qt/6.7.0/qtdatavis3d-everywhere-src-6.7.0.tar.xz) = 3947500 +TIMESTAMP = 1716400800 +SHA256 (KDE/Qt/6.7.1/qtdatavis3d-everywhere-src-6.7.1.tar.xz) = ea0d10cd2fefbfa71aa7e8a83bf61a61b845c41b95458b5b82cb603beb621a7c +SIZE (KDE/Qt/6.7.1/qtdatavis3d-everywhere-src-6.7.1.tar.xz) = 3948188 diff --git a/x11-toolkits/qt6-declarative/distinfo b/x11-toolkits/qt6-declarative/distinfo index 4f305ee3f833..c8f41220fb47 100644 --- a/x11-toolkits/qt6-declarative/distinfo +++ b/x11-toolkits/qt6-declarative/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712115587 -SHA256 (KDE/Qt/6.7.0/qtdeclarative-everywhere-src-6.7.0.tar.xz) = 5a0c39579a74d7cca581162c866ed0887287d4f8d5abff7ab9492d4a58fa9e2c -SIZE (KDE/Qt/6.7.0/qtdeclarative-everywhere-src-6.7.0.tar.xz) = 35360444 +TIMESTAMP = 1716400841 +SHA256 (KDE/Qt/6.7.1/qtdeclarative-everywhere-src-6.7.1.tar.xz) = 81135c96ed2f599385b8a68c57f4f438dad193c62f946f5b200a321558fd9f1c +SIZE (KDE/Qt/6.7.1/qtdeclarative-everywhere-src-6.7.1.tar.xz) = 35624448 diff --git a/x11-toolkits/qt6-declarative/pkg-plist b/x11-toolkits/qt6-declarative/pkg-plist index bab598017b2f..0864b85e1a74 100644 --- a/x11-toolkits/qt6-declarative/pkg-plist +++ b/x11-toolkits/qt6-declarative/pkg-plist @@ -2384,8 +2384,8 @@ lib/cmake/Qt6QuickWidgets/Qt6QuickWidgetsVersionlessTargets.cmake %%QT_MKSPECDIR%%/modules/qt_lib_quicktestutilsprivate_private.pri %%QT_MKSPECDIR%%/modules/qt_lib_quickwidgets.pri %%QT_MKSPECDIR%%/modules/qt_lib_quickwidgets_private.pri -%%DEBUG%%%%QT_LIBDIR%%/objects-Debug/QmlTypeRegistrarPrivate_resources_1/.rcc/qrc_jsRootMetaTypes_init.cpp.o -%%NO_DEBUG%%%%QT_LIBDIR%%/objects-Release/QmlTypeRegistrarPrivate_resources_1/.rcc/qrc_jsRootMetaTypes_init.cpp.o +%%DEBUG%%%%QT_LIBDIR%%/objects-Debug/QmlTypeRegistrarPrivate_resources_1/.qt/rcc/qrc_jsRootMetaTypes_init.cpp.o +%%NO_DEBUG%%%%QT_LIBDIR%%/objects-Release/QmlTypeRegistrarPrivate_resources_1/.qt/rcc/qrc_jsRootMetaTypes_init.cpp.o %%QT_PLUGINDIR%%/qmllint/libquicklintplugin.so %%QT_PLUGINDIR%%/qmltooling/libqmldbg_debugger.so %%QT_PLUGINDIR%%/qmltooling/libqmldbg_inspector.so @@ -2423,8 +2423,8 @@ lib/cmake/Qt6QuickWidgets/Qt6QuickWidgetsVersionlessTargets.cmake %%QT_QMLDIR%%/Qt/labs/wavefrontmesh/qmldir %%QT_QMLDIR%%/Qt/test/controls/QuickControlsTestUtilsPrivate.qmltypes %%QT_QMLDIR%%/Qt/test/controls/libquickcontrolstestutilsprivateplugin.so -%%DEBUG%%%%QT_QMLDIR%%/Qt/test/controls/objects-Debug/QuickControlsTestUtilsPrivate_resources_1/.rcc/qrc_qmake_Qt_test_controls_init.cpp.o -%%NO_DEBUG%%%%QT_QMLDIR%%/Qt/test/controls/objects-Release/QuickControlsTestUtilsPrivate_resources_1/.rcc/qrc_qmake_Qt_test_controls_init.cpp.o +%%DEBUG%%%%QT_QMLDIR%%/Qt/test/controls/objects-Debug/QuickControlsTestUtilsPrivate_resources_1/.qt/rcc/qrc_qmake_Qt_test_controls_init.cpp.o +%%NO_DEBUG%%%%QT_QMLDIR%%/Qt/test/controls/objects-Release/QuickControlsTestUtilsPrivate_resources_1/.qt/rcc/qrc_qmake_Qt_test_controls_init.cpp.o %%QT_QMLDIR%%/Qt/test/controls/qmldir %%QT_QMLDIR%%/QtCore/libqtqmlcoreplugin.so %%QT_QMLDIR%%/QtCore/plugins.qmltypes diff --git a/x11-toolkits/qt6-graphs/distinfo b/x11-toolkits/qt6-graphs/distinfo index c9f12258650f..405a541675ee 100644 --- a/x11-toolkits/qt6-graphs/distinfo +++ b/x11-toolkits/qt6-graphs/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712115596 -SHA256 (KDE/Qt/6.7.0/qtgraphs-everywhere-src-6.7.0.tar.xz) = 4b35d1967e62af0f9d224c173921f22256e29fbbf62ed9de828466c5878b9495 -SIZE (KDE/Qt/6.7.0/qtgraphs-everywhere-src-6.7.0.tar.xz) = 4393072 +TIMESTAMP = 1716400847 +SHA256 (KDE/Qt/6.7.1/qtgraphs-everywhere-src-6.7.1.tar.xz) = 71584a991c89a2fef4a9ad36040eba67700908f314a5fe734098096ef4ffbc38 +SIZE (KDE/Qt/6.7.1/qtgraphs-everywhere-src-6.7.1.tar.xz) = 4395880 diff --git a/x11-toolkits/qt6-graphs/pkg-plist b/x11-toolkits/qt6-graphs/pkg-plist index 62081b60f5fb..5689ba3dfb86 100644 --- a/x11-toolkits/qt6-graphs/pkg-plist +++ b/x11-toolkits/qt6-graphs/pkg-plist @@ -183,18 +183,32 @@ lib/cmake/Qt6Qml/QmlPlugins/Qt6GraphspluginTargets.cmake %%QT_MKSPECDIR%%/modules/qt_lib_graphs.pri %%QT_MKSPECDIR%%/modules/qt_lib_graphs_private.pri %%QT_QMLDIR%%/QtGraphs/Graphs.qmltypes -%%QT_QMLDIR%%/QtGraphs/graphs2d/qml/designer/GraphsViewSpecifics.qml -%%QT_QMLDIR%%/QtGraphs/graphs2d/qml/designer/default/BarSeries.qml -%%QT_QMLDIR%%/QtGraphs/graphs2d/qml/designer/default/LineSeries.qml -%%QT_QMLDIR%%/QtGraphs/graphs2d/qml/designer/default/ScatterSeries.qml -%%QT_QMLDIR%%/QtGraphs/graphs3d/qml/designer/Bars3DSpecifics.qml -%%QT_QMLDIR%%/QtGraphs/graphs3d/qml/designer/GraphsCameraSection.qml -%%QT_QMLDIR%%/QtGraphs/graphs3d/qml/designer/GraphsSection.qml -%%QT_QMLDIR%%/QtGraphs/graphs3d/qml/designer/Scatter3DSpecifics.qml -%%QT_QMLDIR%%/QtGraphs/graphs3d/qml/designer/Surface3DSpecifics.qml -%%QT_QMLDIR%%/QtGraphs/graphs3d/qml/designer/default/Bars3D.qml -%%QT_QMLDIR%%/QtGraphs/graphs3d/qml/designer/default/Scatter3D.qml -%%QT_QMLDIR%%/QtGraphs/graphs3d/qml/designer/default/Surface3D.qml +%%QT_QMLDIR%%/QtGraphs/designer/Bars3DSpecifics.qml +%%QT_QMLDIR%%/QtGraphs/designer/GraphsCameraSection.qml +%%QT_QMLDIR%%/QtGraphs/designer/GraphsSection.qml +%%QT_QMLDIR%%/QtGraphs/designer/GraphsViewSpecifics.qml +%%QT_QMLDIR%%/QtGraphs/designer/Scatter3DSpecifics.qml +%%QT_QMLDIR%%/QtGraphs/designer/Surface3DSpecifics.qml +%%QT_QMLDIR%%/QtGraphs/designer/default/BarSeries.qml +%%QT_QMLDIR%%/QtGraphs/designer/default/Bars3D.qml +%%QT_QMLDIR%%/QtGraphs/designer/default/LineSeries.qml +%%QT_QMLDIR%%/QtGraphs/designer/default/Scatter3D.qml +%%QT_QMLDIR%%/QtGraphs/designer/default/ScatterSeries.qml +%%QT_QMLDIR%%/QtGraphs/designer/default/Surface3D.qml +%%QT_QMLDIR%%/QtGraphs/designer/images/bars3d-icon.png +%%QT_QMLDIR%%/QtGraphs/designer/images/bars3d-icon16.png +%%QT_QMLDIR%%/QtGraphs/designer/images/barseries-icon.png +%%QT_QMLDIR%%/QtGraphs/designer/images/barseries-icon16.png +%%QT_QMLDIR%%/QtGraphs/designer/images/lineseries-chart-icon.png +%%QT_QMLDIR%%/QtGraphs/designer/images/lineseries-chart-icon16.png +%%QT_QMLDIR%%/QtGraphs/designer/images/scatter3d-icon.png +%%QT_QMLDIR%%/QtGraphs/designer/images/scatter3d-icon16.png +%%QT_QMLDIR%%/QtGraphs/designer/images/scatterseries-chart-icon.png +%%QT_QMLDIR%%/QtGraphs/designer/images/scatterseries-chart-icon16.png +%%QT_QMLDIR%%/QtGraphs/designer/images/surface3d-icon.png +%%QT_QMLDIR%%/QtGraphs/designer/images/surface3d-icon16.png +%%QT_QMLDIR%%/QtGraphs/designer/qtgraphs.metainfo +%%QT_QMLDIR%%/QtGraphs/designer/qtgraphs2d.metainfo %%QT_QMLDIR%%/QtGraphs/libgraphsplugin.so %%QT_QMLDIR%%/QtGraphs/qmldir libdata/pkgconfig/Qt6Graphs.pc diff --git a/x11-toolkits/qt6-quick3d/distinfo b/x11-toolkits/qt6-quick3d/distinfo index c1dd417afdbc..dcb6701d6305 100644 --- a/x11-toolkits/qt6-quick3d/distinfo +++ b/x11-toolkits/qt6-quick3d/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712115683 -SHA256 (KDE/Qt/6.7.0/qtquick3d-everywhere-src-6.7.0.tar.xz) = 8bb943bf3f65a933b74fcd93d927e22b8621484030586c15586728e2f67ed910 -SIZE (KDE/Qt/6.7.0/qtquick3d-everywhere-src-6.7.0.tar.xz) = 66175916 +TIMESTAMP = 1716400903 +SHA256 (KDE/Qt/6.7.1/qtquick3d-everywhere-src-6.7.1.tar.xz) = ce390dcc7fbbda2004bcfdaa980986b137b83cbeb12d55c1c880a13995a93fe9 +SIZE (KDE/Qt/6.7.1/qtquick3d-everywhere-src-6.7.1.tar.xz) = 66184636 diff --git a/x11-toolkits/qt6-quicktimeline/distinfo b/x11-toolkits/qt6-quicktimeline/distinfo index 71c1b1e4ffe5..27a7a3572308 100644 --- a/x11-toolkits/qt6-quicktimeline/distinfo +++ b/x11-toolkits/qt6-quicktimeline/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712115685 -SHA256 (KDE/Qt/6.7.0/qtquicktimeline-everywhere-src-6.7.0.tar.xz) = eb45657c6c6b5d57775473d4d69e7d964a17778695ffb2ff50a75aa1b63489bd -SIZE (KDE/Qt/6.7.0/qtquicktimeline-everywhere-src-6.7.0.tar.xz) = 109548 +TIMESTAMP = 1716400905 +SHA256 (KDE/Qt/6.7.1/qtquicktimeline-everywhere-src-6.7.1.tar.xz) = 2d79204d87b7a13cb0154f1ab705afcd1f8c668c0a03e0694205141f54725744 +SIZE (KDE/Qt/6.7.1/qtquicktimeline-everywhere-src-6.7.1.tar.xz) = 110116 diff --git a/x11-toolkits/qt6-shadertools/distinfo b/x11-toolkits/qt6-shadertools/distinfo index 39a06805f2e3..eb7151299072 100644 --- a/x11-toolkits/qt6-shadertools/distinfo +++ b/x11-toolkits/qt6-shadertools/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712115689 -SHA256 (KDE/Qt/6.7.0/qtshadertools-everywhere-src-6.7.0.tar.xz) = 3e13f967c62f0815c901e754cbc472a2e19170da0c7a505230d559615f7998af -SIZE (KDE/Qt/6.7.0/qtshadertools-everywhere-src-6.7.0.tar.xz) = 1110704 +TIMESTAMP = 1716400908 +SHA256 (KDE/Qt/6.7.1/qtshadertools-everywhere-src-6.7.1.tar.xz) = e585e3a985b2e2bad8191a84489a04e69c3defc6022a8e746aad22a1f17910c2 +SIZE (KDE/Qt/6.7.1/qtshadertools-everywhere-src-6.7.1.tar.xz) = 1111284 diff --git a/x11-toolkits/qt6-virtualkeyboard/distinfo b/x11-toolkits/qt6-virtualkeyboard/distinfo index 0d909de78e6d..61920d0bab91 100644 --- a/x11-toolkits/qt6-virtualkeyboard/distinfo +++ b/x11-toolkits/qt6-virtualkeyboard/distinfo @@ -1,3 +1,3 @@ -TIMESTAMP = 1712115695 -SHA256 (KDE/Qt/6.7.0/qtvirtualkeyboard-everywhere-src-6.7.0.tar.xz) = d61bb2a18b1b06f64c956b2bde740c90a4bb46c47a99b31462e6e8d278a0cb6a -SIZE (KDE/Qt/6.7.0/qtvirtualkeyboard-everywhere-src-6.7.0.tar.xz) = 3720012 +TIMESTAMP = 1716400913 +SHA256 (KDE/Qt/6.7.1/qtvirtualkeyboard-everywhere-src-6.7.1.tar.xz) = 7b6cd83d1b7f622f909b38bd429536b9d0829621f2d111b3a2f90d8bcdcba85d +SIZE (KDE/Qt/6.7.1/qtvirtualkeyboard-everywhere-src-6.7.1.tar.xz) = 3729484