ports/www/qt6-webengine/files/patch-security-rollup

diff --git a/chromium/gpu/config/software_rendering_list.json b/chromium/gpu/config/software_rendering_list.json
index 79ea316cf4c6..59eefa4d8043 100644
--- src/3rdparty/chromium/gpu/config/software_rendering_list.json
+++ src/3rdparty/chromium/gpu/config/software_rendering_list.json
@@ -1225,6 +1225,18 @@
         "accelerated_webgl2"
       ]
     },
+    {
+      "id": 158,
+      "description": "Recurring canvas rendering issues on Intel with direct rendering: https://bugreports.qt.io/browse/QTBUG-130404",
+      "os": {
+        "type": "linux"
+      },
+      "gl_type": "gl",
+      "vendor_id": "0x8086",
+      "features": [
+        "accelerated_2d_canvas"
+      ]
+    },
     {
       "id": 159,
       "cr_bugs": [902247],
diff --git a/chromium/net/http/http_auth_cache.cc b/chromium/net/http/http_auth_cache.cc
index a74721b202b3..70b870c0d025 100644
--- src/3rdparty/chromium/net/http/http_auth_cache.cc
+++ src/3rdparty/chromium/net/http/http_auth_cache.cc
@@ -87,7 +87,7 @@ void HttpAuthCache::SetKeyServerEntriesByNetworkAnonymizationKey(
 
   key_server_entries_by_network_anonymization_key_ =
       key_server_entries_by_network_anonymization_key;
-  std::erase_if(entries_, [](EntryMap::value_type& entry_map_pair) {
+  std::erase_if(entries_, [](const EntryMap::value_type& entry_map_pair) {
     return entry_map_pair.first.target == HttpAuth::AUTH_SERVER;
   });
 }
@@ -311,9 +311,9 @@ void HttpAuthCache::ClearEntriesAddedBetween(
     ClearAllEntries();
     return;
   }
-  std::erase_if(entries_, [begin_time, end_time,
-                           url_matcher](EntryMap::value_type& entry_map_pair) {
-    Entry& entry = entry_map_pair.second;
+  std::erase_if(entries_, [begin_time, end_time, url_matcher](
+                              const EntryMap::value_type& entry_map_pair) {
+    const Entry& entry = entry_map_pair.second;
     return entry.creation_time_ >= begin_time &&
            entry.creation_time_ < end_time &&
            (url_matcher ? url_matcher.Run(entry.scheme_host_port().GetURL())
diff --git a/chromium/third_party/dawn/src/tint/lang/msl/writer/ast_raise/packed_vec3.cc b/chromium/third_party/dawn/src/tint/lang/msl/writer/ast_raise/packed_vec3.cc
index 6ef52b2c1714..c0b32a733ad0 100644
--- src/3rdparty/chromium/third_party/dawn/src/tint/lang/msl/writer/ast_raise/packed_vec3.cc
+++ src/3rdparty/chromium/third_party/dawn/src/tint/lang/msl/writer/ast_raise/packed_vec3.cc
@@ -83,6 +83,14 @@ struct PackedVec3::State {
     /// A map from type to the name of a helper function used to unpack that type.
     Hashmap<const core::type::Type*, Symbol, 4> unpack_helpers;
 
+    /// @returns true if @p addrspace requires vec3 types to be packed
+    bool AddressSpaceNeedsPacking(core::AddressSpace addrspace) {
+        // Host-shareable address spaces need to be packed to match the memory layout on the host.
+        // The workgroup address space needs to be packed so that the size of generated threadgroup
+        // variables matches the size of the original WGSL declarations.
+        return core::IsHostShareable(addrspace) || addrspace == core::AddressSpace::kWorkgroup;
+    }
+
     /// @param ty the type to test
     /// @returns true if `ty` is a vec3, false otherwise
     bool IsVec3(const core::type::Type* ty) {
@@ -374,7 +382,7 @@ struct PackedVec3::State {
         // if the transform is necessary.
         for (auto* decl : src.AST().GlobalVariables()) {
             auto* var = sem.Get<sem::GlobalVariable>(decl);
-            if (var && core::IsHostShareable(var->AddressSpace()) &&
+            if (var && AddressSpaceNeedsPacking(var->AddressSpace()) &&
                 ContainsVec3(var->Type()->UnwrapRef())) {
                 return true;
             }
@@ -411,7 +419,7 @@ struct PackedVec3::State {
                 [&](const sem::TypeExpression* type) {
                     // Rewrite pointers to types that contain vec3s.
                     auto* ptr = type->Type()->As<core::type::Pointer>();
-                    if (ptr && core::IsHostShareable(ptr->AddressSpace())) {
+                    if (ptr && AddressSpaceNeedsPacking(ptr->AddressSpace())) {
                         auto new_store_type = RewriteType(ptr->StoreType());
                         if (new_store_type) {
                             auto access = ptr->AddressSpace() == core::AddressSpace::kStorage
@@ -424,7 +432,7 @@ struct PackedVec3::State {
                     }
                 },
                 [&](const sem::Variable* var) {
-                    if (!core::IsHostShareable(var->AddressSpace())) {
+                    if (!AddressSpaceNeedsPacking(var->AddressSpace())) {
                         return;
                     }
 
@@ -440,7 +448,7 @@ struct PackedVec3::State {
                         auto* lhs = sem.GetVal(assign->lhs);
                         auto* rhs = sem.GetVal(assign->rhs);
                         if (!ContainsVec3(rhs->Type()) ||
-                            !core::IsHostShareable(
+                            !AddressSpaceNeedsPacking(
                                 lhs->Type()->As<core::type::Reference>()->AddressSpace())) {
                             // Skip assignments to address spaces that are not host-shareable, or
                             // that do not contain vec3 types.
@@ -468,7 +476,7 @@ struct PackedVec3::State {
                 [&](const sem::Load* load) {
                     // Unpack loads of types that contain vec3s in host-shareable address spaces.
                     if (ContainsVec3(load->Type()) &&
-                        core::IsHostShareable(load->ReferenceType()->AddressSpace())) {
+                        AddressSpaceNeedsPacking(load->ReferenceType()->AddressSpace())) {
                         to_unpack.Add(load);
                     }
                 },
@@ -478,7 +486,7 @@ struct PackedVec3::State {
                     // struct.
                     if (auto* ref = accessor->Type()->As<core::type::Reference>()) {
                         if (IsVec3(ref->StoreType()) &&
-                            core::IsHostShareable(ref->AddressSpace())) {
+                            AddressSpaceNeedsPacking(ref->AddressSpace())) {
                             ctx.Replace(node, b.MemberAccessor(ctx.Clone(accessor->Declaration()),
                                                                kStructMemberName));
                         }
diff --git a/chromium/third_party/dawn/src/tint/lang/wgsl/resolver/validator.cc b/chromium/third_party/dawn/src/tint/lang/wgsl/resolver/validator.cc
index fa310d6d09c1..c071466606cf 100644
--- src/3rdparty/chromium/third_party/dawn/src/tint/lang/wgsl/resolver/validator.cc
+++ src/3rdparty/chromium/third_party/dawn/src/tint/lang/wgsl/resolver/validator.cc
@@ -493,10 +493,6 @@ bool Validator::AddressSpaceLayout(const core::type::Type* store_ty,
         return true;
     }
 
-    if (!core::IsHostShareable(address_space)) {
-        return true;
-    }
-
     auto note_usage = [&] {
         AddNote("'" + store_ty->FriendlyName() + "' used in address space '" +
                     tint::ToString(address_space) + "' here",
diff --git a/chromium/v8/src/wasm/baseline/x64/liftoff-assembler-x64-inl.h b/chromium/v8/src/wasm/baseline/x64/liftoff-assembler-x64-inl.h
index 480626895fb6..b1d1ec3924e6 100644
--- src/3rdparty/chromium/v8/src/wasm/baseline/x64/liftoff-assembler-x64-inl.h
+++ src/3rdparty/chromium/v8/src/wasm/baseline/x64/liftoff-assembler-x64-inl.h
@@ -56,6 +56,8 @@ constexpr Operand kInstanceDataOperand = GetStackSlot(kInstanceOffset);
 
 constexpr Operand kOSRTargetSlot = GetStackSlot(kOSRTargetOffset);
 
+// Note: The returned Operand might contain {kScratchRegister2}; make sure not
+// to clobber that until after the last use of the Operand.
 inline Operand GetMemOp(LiftoffAssembler* assm, Register addr,
                         Register offset_reg, uintptr_t offset_imm,
                         ScaleFactor scale_factor = times_1) {
@@ -66,7 +68,7 @@ inline Operand GetMemOp(LiftoffAssembler* assm, Register addr,
                : Operand(addr, offset_reg, scale_factor, offset_imm32);
   }
   // Offset immediate does not fit in 31 bits.
-  Register scratch = kScratchRegister;
+  Register scratch = kScratchRegister2;
   assm->MacroAssembler::Move(scratch, offset_imm);
   if (offset_reg != no_reg) assm->addq(scratch, offset_reg);
   return Operand(addr, scratch, scale_factor, 0);