Merge remote-tracking branch 'origin/5.15.2' into 5.15

Change-Id: I516761e18c03c6cfd4d44a6ee176a2add9a5b022

6 files changed, 29 insertions, 17 deletions

diff --git a/dist/changes-5.15.2 b/dist/changes-5.15.2
index de6ffc584..792b9afd6 100644
--- a/dist/changes-5.15.2
+++ b/dist/changes-5.15.2
@@ -39,7 +39,7 @@ Chromium
 --------
 
   - The Chromium version has been updated to 83.0.4103.122
-  - Security fixes from Chromium up to version 86.0.4240.111, including:
+  - Security fixes from Chromium up to version 86.0.4240.183, including:
     - CVE-2020-6540: Heap buffer overflow in Skia
     - CVE-2020-6557: Inappropriate implementation in networking
     - CVE-2020-6561: Inappropriate implementation in Content Security Policy
@@ -75,8 +75,12 @@ Chromium
     - CVE-2020-16001: Use after free in media.
     - CVE-2020-16002: Use after free in PDFium
     - CVE-2020-16003: Use after free in printing
+    - CVE-2020-16005: Insufficient policy enforcement in ANGLE
+    - CVE-2020-16008: Stack buffer overflow in WebRTC
+    - CVE-2020-16009: Inappropriate implementation in V8
+    - CVE-2020-16011: Heap buffer overflow in UI on Windows.
     - Security bug 1106091
     - Security bug 1107824
     - Security bug 1111149
     - Security bug 1125199
-
+    - Security bug 1137608
diff --git a/src/3rdparty b/src/3rdparty
-Subproject c5637fa9071bb6d53b5d21ac713f2a5191f8c16
+Subproject fb6ab5e483876298235be1c6a6013b426c82b75
diff --git a/src/core/media_capture_devices_dispatcher.cpp b/src/core/media_capture_devices_dispatcher.cpp
index ecc3347f8..65c3df06a 100644
--- a/src/core/media_capture_devices_dispatcher.cpp
+++ b/src/core/media_capture_devices_dispatcher.cpp
@@ -322,7 +322,8 @@ void MediaCaptureDevicesDispatcher::handleMediaAccessPermissionResponse(content:
                 break;
             }
         } else if (desktopVideoRequested) {
-            getDevicesForDesktopCapture(&devices, getDefaultScreenId(), desktopAudioRequested,
+            bool captureAudio = desktopAudioRequested && m_loopbackAudioSupported;
+            getDevicesForDesktopCapture(&devices, getDefaultScreenId(), captureAudio,
                                         request.video_type, request.audio_type);
         }
     }
@@ -359,6 +360,10 @@ MediaCaptureDevicesDispatcher::MediaCaptureDevicesDispatcher()
     // content::NOTIFICATION_WEB_CONTENTS_DESTROYED, and that will result in
     // possible use after free.
     DCHECK_CURRENTLY_ON(BrowserThread::UI);
+#if defined(OS_WIN)
+    // Currently loopback audio capture is supported only on Windows.
+    m_loopbackAudioSupported = true;
+#endif
     m_notificationsRegistrar.Add(this, content::NOTIFICATION_WEB_CONTENTS_DESTROYED,
                                  content::NotificationService::AllSources());
 }
@@ -433,9 +438,11 @@ void MediaCaptureDevicesDispatcher::processDesktopCaptureAccessRequest(content::
     }
 
     // Audio is only supported for screen capture streams.
-    bool capture_audio = (mediaId.type == content::DesktopMediaID::TYPE_SCREEN && request.audio_type == MediaStreamType::GUM_DESKTOP_AUDIO_CAPTURE);
+    bool audioRequested = request.audio_type == MediaStreamType::GUM_DESKTOP_AUDIO_CAPTURE;
+    bool audioSupported = (mediaId.type == content::DesktopMediaID::TYPE_SCREEN && m_loopbackAudioSupported);
+    bool captureAudio = (audioRequested && audioSupported);
 
-    getDevicesForDesktopCapture(&devices, mediaId, capture_audio, request.video_type, request.audio_type);
+    getDevicesForDesktopCapture(&devices, mediaId, captureAudio, request.video_type, request.audio_type);
 
     if (devices.empty())
         std::move(callback).Run(devices, MediaStreamRequestResult::INVALID_STATE,
diff --git a/src/core/media_capture_devices_dispatcher.h b/src/core/media_capture_devices_dispatcher.h
index 6a67a53e9..17cb5d5c9 100644
--- a/src/core/media_capture_devices_dispatcher.h
+++ b/src/core/media_capture_devices_dispatcher.h
@@ -127,6 +127,8 @@ private:
 
     content::NotificationRegistrar m_notificationsRegistrar;
 
+    bool m_loopbackAudioSupported = false;
+
     DISALLOW_COPY_AND_ASSIGN(MediaCaptureDevicesDispatcher);
 };
 
diff --git a/src/core/ozone/gl_ozone_egl_qt.cpp b/src/core/ozone/gl_ozone_egl_qt.cpp
index c33570d44..04b336990 100644
--- a/src/core/ozone/gl_ozone_egl_qt.cpp
+++ b/src/core/ozone/gl_ozone_egl_qt.cpp
@@ -40,14 +40,6 @@
 #if defined(USE_OZONE)
 #include <QtCore/qobject.h>
 #include <QtGui/qtgui-config.h>
-
-#if QT_CONFIG(opengl)
-#include <QOpenGLContext>
-QT_BEGIN_NAMESPACE
-Q_GUI_EXPORT QOpenGLContext *qt_gl_global_share_context();
-QT_END_NAMESPACE
-#endif
-
 #include "gl_context_qt.h"
 #include "gl_ozone_egl_qt.h"
 #include "gl_surface_egl_qt.h"
@@ -90,10 +82,8 @@ bool GLOzoneEGLQt::LoadGLES2Bindings(gl::GLImplementation /*implementation*/)
 #if QT_CONFIG(opengl)
     if (!get_proc_address) {
         // QTBUG-63341 most likely libgles2 not linked with libegl -> fallback to qpa
-        if (QOpenGLContext *context = qt_gl_global_share_context()) {
-            get_proc_address = reinterpret_cast<gl::GLGetProcAddressProc>(
-                context->getProcAddress("eglGetProcAddress"));
-        }
+        get_proc_address =
+                reinterpret_cast<gl::GLGetProcAddressProc>(GLContextHelper::getEglGetProcAddress());
     }
 #endif
 
diff --git a/tests/auto/widgets/qwebengineview/tst_qwebengineview.cpp b/tests/auto/widgets/qwebengineview/tst_qwebengineview.cpp
index 0b7356034..2257a6f4e 100644
--- a/tests/auto/widgets/qwebengineview/tst_qwebengineview.cpp
+++ b/tests/auto/widgets/qwebengineview/tst_qwebengineview.cpp
@@ -1240,6 +1240,7 @@ void tst_QWebEngineView::inputMethodsTextFormat()
 
     evaluateJavaScriptSync(view.page(), "document.getElementById('input1').focus()");
     view.show();
+    QVERIFY(QTest::qWaitForWindowExposed(&view));
 
     QFETCH(QString, string);
     QFETCH(int, start);
@@ -1842,6 +1843,7 @@ void tst_QWebEngineView::inputContextQueryInput()
                  "  <input type='text' id='input1' value='' size='50'/>"
                  "</body></html>");
     QTRY_COMPARE(loadFinishedSpy.count(), 1);
+    QVERIFY(QTest::qWaitForWindowExposed(&view));
     QCOMPARE(testContext.infos.count(), 0);
 
     // Set focus on an input field.
@@ -1993,6 +1995,7 @@ void tst_QWebEngineView::inputMethods()
                  "  <input type='text' id='input1' style='font-family: serif' value='' maxlength='20' size='50'/>"
                  "</body></html>");
     QTRY_COMPARE(loadFinishedSpy.size(), 1);
+    QVERIFY(QTest::qWaitForWindowExposed(&view));
 
     QPoint textInputCenter = elementCenter(view.page(), "input1");
     QTest::mouseClick(view.focusProxy(), Qt::LeftButton, {}, textInputCenter);
@@ -2090,6 +2093,7 @@ void tst_QWebEngineView::textSelectionInInputField()
                  "  <input type='text' id='input1' value='QtWebEngine' size='50'/>"
                  "</body></html>");
     QVERIFY(loadFinishedSpy.wait());
+    QVERIFY(QTest::qWaitForWindowExposed(&view));
 
     // Tests for Selection when the Editor is NOT in Composition mode
 
@@ -2302,6 +2306,7 @@ void tst_QWebEngineView::emptyInputMethodEvent()
                  "  <input type='text' id='input1' value='QtWebEngine'/>"
                  "</body></html>");
     QVERIFY(loadFinishedSpy.wait());
+    QVERIFY(QTest::qWaitForWindowExposed(&view));
 
     evaluateJavaScriptSync(view.page(), "var inputEle = document.getElementById('input1'); inputEle.focus(); inputEle.select();");
     QTRY_COMPARE(selectionChangedSpy.count(), 1);
@@ -2350,6 +2355,7 @@ void tst_QWebEngineView::imeComposition()
                  "  <input type='text' id='input1' value='QtWebEngine inputMethod'/>"
                  "</body></html>");
     QVERIFY(loadFinishedSpy.wait());
+    QVERIFY(QTest::qWaitForWindowExposed(&view));
 
     evaluateJavaScriptSync(view.page(), "var inputEle = document.getElementById('input1'); inputEle.focus(); inputEle.select();");
     QTRY_COMPARE(selectionChangedSpy.count(), 1);
@@ -2567,6 +2573,7 @@ void tst_QWebEngineView::newlineInTextarea()
                          "  <textarea rows='5' cols='1' id='input1'></textarea>"
                          "</body></html>");
     QVERIFY(loadFinishedSpy.wait());
+    QVERIFY(QTest::qWaitForWindowExposed(&view));
 
     evaluateJavaScriptSync(view.page(), "var inputEle = document.getElementById('input1'); inputEle.focus(); inputEle.select();");
     QTRY_VERIFY(evaluateJavaScriptSync(view.page(), "document.getElementById('input1').value").toString().isEmpty());
@@ -2691,6 +2698,7 @@ void tst_QWebEngineView::imeJSInputEvents()
                          "  <pre id='log'></pre>"
                          "</body></html>");
     QVERIFY(loadFinishedSpy.wait());
+    QVERIFY(QTest::qWaitForWindowExposed(&view));
 
     evaluateJavaScriptSync(view.page(), "document.getElementById('input').focus()");
     QTRY_COMPARE(evaluateJavaScriptSync(view.page(), "document.activeElement.id").toString(), QStringLiteral("input"));
@@ -2813,6 +2821,7 @@ void tst_QWebEngineView::imeCompositionQueryEvent()
                  "  <input type='text' id='input1' />"
                  "</body></html>");
     QVERIFY(loadFinishedSpy.wait());
+    QVERIFY(QTest::qWaitForWindowExposed(&view));
 
     evaluateJavaScriptSync(view.page(), "document.getElementById('input1').focus()");
     QTRY_COMPARE(evaluateJavaScriptSync(view.page(), "document.activeElement.id").toString(), QStringLiteral("input1"));