BASELINE: Update Chromium to 74.0.3729.159

Change-Id: I8d2497da544c275415aedd94dd25328d555de811
Reviewed-by: Michael Brüning <michael.bruning@qt.io>

12 files changed, 153 insertions, 78 deletions

diff --git a/chromium/third_party/blink/renderer/core/fileapi/blob.cc b/chromium/third_party/blink/renderer/core/fileapi/blob.cc
index 7658bb68538..364ea486703 100644
--- a/chromium/third_party/blink/renderer/core/fileapi/blob.cc
+++ b/chromium/third_party/blink/renderer/core/fileapi/blob.cc
@@ -99,20 +99,20 @@ Blob* Blob::Create(
   PopulateBlobData(blob_data.get(), blob_parts,
                    normalize_line_endings_to_native);
 
-  long long blob_size = blob_data->length();
+  uint64_t blob_size = blob_data->length();
   return MakeGarbageCollected<Blob>(
       BlobDataHandle::Create(std::move(blob_data), blob_size));
 }
 
 Blob* Blob::Create(const unsigned char* data,
-                   size_t bytes,
+                   size_t size,
                    const String& content_type) {
   DCHECK(data);
 
   std::unique_ptr<BlobData> blob_data = BlobData::Create();
   blob_data->SetContentType(content_type);
-  blob_data->AppendBytes(data, bytes);
-  long long blob_size = blob_data->length();
+  blob_data->AppendBytes(data, size);
+  uint64_t blob_size = blob_data->length();
 
   return MakeGarbageCollected<Blob>(
       BlobDataHandle::Create(std::move(blob_data), blob_size));
@@ -172,10 +172,10 @@ Blob* Blob::slice(long long start,
                   long long end,
                   const String& content_type,
                   ExceptionState& exception_state) const {
-  long long size = this->size();
+  uint64_t size = this->size();
   ClampSliceOffsets(size, start, end);
 
-  long long length = end - start;
+  uint64_t length = end - start;
   std::unique_ptr<BlobData> blob_data = BlobData::Create();
   blob_data->SetContentType(NormalizeType(content_type));
   blob_data->AppendBlob(blob_data_handle_, start, length);
diff --git a/chromium/third_party/blink/renderer/core/fileapi/blob.h b/chromium/third_party/blink/renderer/core/fileapi/blob.h
index dbe1e22715e..d5078f17862 100644
--- a/chromium/third_party/blink/renderer/core/fileapi/blob.h
+++ b/chromium/third_party/blink/renderer/core/fileapi/blob.h
@@ -70,13 +70,13 @@ class CORE_EXPORT Blob : public ScriptWrappable,
   }
 
   static Blob* Create(const unsigned char* data,
-                      size_t bytes,
+                      size_t size,
                       const String& content_type);
 
   explicit Blob(scoped_refptr<BlobDataHandle>);
   ~Blob() override;
 
-  virtual unsigned long long size() const { return blob_data_handle_->size(); }
+  virtual uint64_t size() const { return blob_data_handle_->size(); }
   virtual Blob* slice(long long start,
                       long long end,
                       const String& content_type,
diff --git a/chromium/third_party/blink/renderer/core/fileapi/file.cc b/chromium/third_party/blink/renderer/core/fileapi/file.cc
index 45d9c510997..aeb5e2f87c2 100644
--- a/chromium/third_party/blink/renderer/core/fileapi/file.cc
+++ b/chromium/third_party/blink/renderer/core/fileapi/file.cc
@@ -31,6 +31,7 @@
 #include "third_party/blink/public/platform/platform.h"
 #include "third_party/blink/renderer/core/fileapi/file_property_bag.h"
 #include "third_party/blink/renderer/core/frame/use_counter.h"
+#include "third_party/blink/renderer/core/html/forms/form_controller.h"
 #include "third_party/blink/renderer/platform/bindings/exception_state.h"
 #include "third_party/blink/renderer/platform/bindings/script_state.h"
 #include "third_party/blink/renderer/platform/blob/blob_data.h"
@@ -145,11 +146,36 @@ File* File::Create(
   PopulateBlobData(blob_data.get(), file_bits,
                    normalize_line_endings_to_native);
 
-  long long file_size = blob_data->length();
+  uint64_t file_size = blob_data->length();
   return File::Create(file_name, last_modified,
                       BlobDataHandle::Create(std::move(blob_data), file_size));
 }
 
+File* File::CreateFromControlState(const FormControlState& state,
+                                   wtf_size_t& index) {
+  if (index + 2 >= state.ValueSize()) {
+    index = state.ValueSize();
+    return nullptr;
+  }
+  String path = state[index++];
+  String name = state[index++];
+  String relative_path = state[index++];
+  if (relative_path.IsEmpty())
+    return File::CreateForUserProvidedFile(path, name);
+  return File::CreateWithRelativePath(path, relative_path);
+}
+
+String File::PathFromControlState(const FormControlState& state,
+                                  wtf_size_t& index) {
+  if (index + 2 >= state.ValueSize()) {
+    index = state.ValueSize();
+    return String();
+  }
+  String path = state[index];
+  index += 3;
+  return path;
+}
+
 File* File::CreateWithRelativePath(const String& path,
                                    const String& relative_path) {
   File* file = MakeGarbageCollected<File>(path, File::kAllContentTypes,
@@ -161,7 +187,8 @@ File* File::CreateWithRelativePath(const String& path,
 File::File(const String& path,
            ContentTypeLookupPolicy policy,
            UserVisibility user_visibility)
-    : Blob(BlobDataHandle::Create(CreateBlobDataForFile(path, policy), -1)),
+    : Blob(BlobDataHandle::Create(CreateBlobDataForFile(path, policy),
+                                  std::numeric_limits<uint64_t>::max())),
       has_backing_file_(true),
       user_visibility_(user_visibility),
       path_(path),
@@ -296,17 +323,16 @@ double File::lastModifiedDate() const {
   return modified_date;
 }
 
-unsigned long long File::size() const {
+uint64_t File::size() const {
   if (HasValidSnapshotMetadata())
     return snapshot_size_;
 
-  // FIXME: JavaScript cannot represent sizes as large as unsigned long long, we
-  // need to come up with an exception to throw if file size is not
-  // representable.
+  // FIXME: JavaScript cannot represent sizes as large as uint64_t, we need
+  // to come up with an exception to throw if file size is not representable.
   long long size;
   if (!HasBackingFile() || !GetFileSize(path_, size))
     return 0;
-  return static_cast<unsigned long long>(size);
+  return static_cast<uint64_t>(size);
 }
 
 Blob* File::slice(long long start,
@@ -323,7 +349,7 @@ Blob* File::slice(long long start,
   CaptureSnapshot(size, modification_time_ms);
   ClampSliceOffsets(size, start, end);
 
-  long long length = end - start;
+  uint64_t length = end - start;
   std::unique_ptr<BlobData> blob_data = BlobData::Create();
   blob_data->SetContentType(NormalizeType(content_type));
   DCHECK(!path_.IsEmpty());
@@ -386,4 +412,14 @@ bool File::HasSameSource(const File& other) const {
   return Uuid() == other.Uuid();
 }
 
+bool File::AppendToControlState(FormControlState& state) {
+  // FIXME: handle Blob-backed File instances, see http://crbug.com/394948
+  if (!HasBackingFile())
+    return false;
+  state.Append(GetPath());
+  state.Append(name());
+  state.Append(webkitRelativePath());
+  return true;
+}
+
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/fileapi/file.h b/chromium/third_party/blink/renderer/core/fileapi/file.h
index 2ca09ab8903..6ae1e8ed179 100644
--- a/chromium/third_party/blink/renderer/core/fileapi/file.h
+++ b/chromium/third_party/blink/renderer/core/fileapi/file.h
@@ -31,6 +31,7 @@
 #include "third_party/blink/renderer/core/core_export.h"
 #include "third_party/blink/renderer/core/fileapi/blob.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
+#include "third_party/blink/renderer/platform/wtf/casting.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
 
 namespace blink {
@@ -39,6 +40,7 @@ class ExceptionState;
 class ExecutionContext;
 class FilePropertyBag;
 class FileMetadata;
+class FormControlState;
 class KURL;
 
 class CORE_EXPORT File final : public Blob {
@@ -102,6 +104,13 @@ class CORE_EXPORT File final : public Blob {
                                       std::move(blob_data_handle));
   }
 
+  // For session restore feature.
+  // See also AppendToControlState().
+  static File* CreateFromControlState(const FormControlState& state,
+                                      wtf_size_t& index);
+  static String PathFromControlState(const FormControlState& state,
+                                     wtf_size_t& index);
+
   static File* CreateWithRelativePath(const String& path,
                                       const String& relative_path);
 
@@ -174,7 +183,7 @@ class CORE_EXPORT File final : public Blob {
 
   File* Clone(const String& name = String()) const;
 
-  unsigned long long size() const override;
+  uint64_t size() const override;
   Blob* slice(long long start,
               long long end,
               const String& content_type,
@@ -220,6 +229,9 @@ class CORE_EXPORT File final : public Blob {
   // of the file objects are same or not.
   bool HasSameSource(const File& other) const;
 
+  // Return false if this File instance is not serializable to FormControlState.
+  bool AppendToControlState(FormControlState& state);
+
  private:
   void InvalidateSnapshotMetadata() { snapshot_size_ = -1; }
 
@@ -253,7 +265,10 @@ class CORE_EXPORT File final : public Blob {
   String relative_path_;
 };
 
-DEFINE_TYPE_CASTS(File, Blob, blob, blob->IsFile(), blob.IsFile());
+template <>
+struct DowncastTraits<File> {
+  static bool AllowFrom(const Blob& blob) { return blob.IsFile(); }
+};
 
 }  // namespace blink
 
diff --git a/chromium/third_party/blink/renderer/core/fileapi/file_reader.cc b/chromium/third_party/blink/renderer/core/fileapi/file_reader.cc
index 7b595c43579..2d52fa1a2d4 100644
--- a/chromium/third_party/blink/renderer/core/fileapi/file_reader.cc
+++ b/chromium/third_party/blink/renderer/core/fileapi/file_reader.cc
@@ -57,7 +57,7 @@ const CString Utf8BlobUUID(Blob* blob) {
 }
 
 const CString Utf8FilePath(Blob* blob) {
-  return blob->HasBackingFile() ? ToFile(blob)->GetPath().Utf8() : "";
+  return blob->HasBackingFile() ? To<File>(blob)->GetPath().Utf8() : "";
 }
 
 }  // namespace
@@ -316,7 +316,9 @@ void FileReader::ExecutePendingRead() {
   DCHECK_EQ(loading_state_, kLoadingStatePending);
   loading_state_ = kLoadingStateLoading;
 
-  loader_ = FileReaderLoader::Create(read_type_, this);
+  loader_ = std::make_unique<FileReaderLoader>(
+      read_type_, this,
+      GetExecutionContext()->GetTaskRunner(TaskType::kFileReading));
   loader_->SetEncoding(encoding_);
   loader_->SetDataType(blob_type_);
   loader_->Start(blob_data_handle_);
diff --git a/chromium/third_party/blink/renderer/core/fileapi/file_reader.h b/chromium/third_party/blink/renderer/core/fileapi/file_reader.h
index 7c5cfd40127..17ed1a4e701 100644
--- a/chromium/third_party/blink/renderer/core/fileapi/file_reader.h
+++ b/chromium/third_party/blink/renderer/core/fileapi/file_reader.h
@@ -34,8 +34,8 @@
 #include <memory>
 #include "third_party/blink/renderer/bindings/core/v8/active_script_wrappable.h"
 #include "third_party/blink/renderer/core/core_export.h"
-#include "third_party/blink/renderer/core/dom/context_lifecycle_observer.h"
 #include "third_party/blink/renderer/core/dom/events/event_target.h"
+#include "third_party/blink/renderer/core/execution_context/context_lifecycle_observer.h"
 #include "third_party/blink/renderer/core/fileapi/file_reader_loader.h"
 #include "third_party/blink/renderer/core/fileapi/file_reader_loader_client.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
@@ -93,12 +93,12 @@ class CORE_EXPORT FileReader final : public EventTargetWithInlineData,
   void DidFinishLoading() override;
   void DidFail(FileErrorCode) override;
 
-  DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart, kLoadstart);
-  DEFINE_ATTRIBUTE_EVENT_LISTENER(progress, kProgress);
-  DEFINE_ATTRIBUTE_EVENT_LISTENER(load, kLoad);
-  DEFINE_ATTRIBUTE_EVENT_LISTENER(abort, kAbort);
-  DEFINE_ATTRIBUTE_EVENT_LISTENER(error, kError);
-  DEFINE_ATTRIBUTE_EVENT_LISTENER(loadend, kLoadend);
+  DEFINE_ATTRIBUTE_EVENT_LISTENER(loadstart, kLoadstart)
+  DEFINE_ATTRIBUTE_EVENT_LISTENER(progress, kProgress)
+  DEFINE_ATTRIBUTE_EVENT_LISTENER(load, kLoad)
+  DEFINE_ATTRIBUTE_EVENT_LISTENER(abort, kAbort)
+  DEFINE_ATTRIBUTE_EVENT_LISTENER(error, kError)
+  DEFINE_ATTRIBUTE_EVENT_LISTENER(loadend, kLoadend)
 
   void Trace(blink::Visitor*) override;
 
diff --git a/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.cc b/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.cc
index 36491a4b86f..e4166554895 100644
--- a/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.cc
+++ b/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.cc
@@ -62,21 +62,21 @@
 
 namespace blink {
 
-// static
-std::unique_ptr<FileReaderLoader> FileReaderLoader::Create(
+FileReaderLoader::FileReaderLoader(
     ReadType read_type,
-    FileReaderLoaderClient* client) {
-  return std::make_unique<FileReaderLoader>(read_type, client);
-}
-
-FileReaderLoader::FileReaderLoader(ReadType read_type,
-                                   FileReaderLoaderClient* client)
+    FileReaderLoaderClient* client,
+    scoped_refptr<base::SingleThreadTaskRunner> task_runner)
     : read_type_(read_type),
       client_(client),
-      // TODO(hajimehoshi): Pass an appropriate task runner to SimpleWatcher
-      // constructor.
-      handle_watcher_(FROM_HERE, mojo::SimpleWatcher::ArmingPolicy::AUTOMATIC),
+      // TODO(https://crbug.com/957651): task_runner should never be null, but
+      // if it is make sure SimpleWatcher doesn't crash and just use a default
+      // task runner instead for now.
+      handle_watcher_(
+          FROM_HERE,
+          mojo::SimpleWatcher::ArmingPolicy::AUTOMATIC,
+          task_runner ? task_runner : base::SequencedTaskRunnerHandle::Get()),
       binding_(this),
+      task_runner_(std::move(task_runner)),
       weak_factory_(this) {}
 
 FileReaderLoader::~FileReaderLoader() {
@@ -105,7 +105,7 @@ void FileReaderLoader::Start(scoped_refptr<BlobDataHandle> blob_data) {
   }
 
   mojom::blink::BlobReaderClientPtr client_ptr;
-  binding_.Bind(MakeRequest(&client_ptr));
+  binding_.Bind(MakeRequest(&client_ptr, task_runner_), task_runner_);
   blob_data->ReadAll(std::move(producer_handle), std::move(client_ptr));
 
   if (IsSyncLoad()) {
@@ -144,13 +144,12 @@ DOMArrayBuffer* FileReaderLoader::ArrayBufferResult() {
     return nullptr;
 
   if (!finished_loading_) {
-    return DOMArrayBuffer::Create(
-        ArrayBuffer::Create(raw_data_->Data(), raw_data_->ByteLength()));
+    return DOMArrayBuffer::Create(ArrayBuffer::Create(
+        raw_data_->Data(), static_cast<unsigned>(bytes_loaded_)));
   }
 
-  array_buffer_result_ = DOMArrayBuffer::Create(raw_data_->ToArrayBuffer());
-  AdjustReportedMemoryUsageToV8(-1 *
-                                static_cast<int64_t>(raw_data_->ByteLength()));
+  array_buffer_result_ = DOMArrayBuffer::Create(std::move(raw_data_));
+  AdjustReportedMemoryUsageToV8(-1 * static_cast<int64_t>(bytes_loaded_));
   raw_data_.reset();
   return array_buffer_result_;
 }
@@ -169,7 +168,8 @@ String FileReaderLoader::StringResult() {
       // No conversion is needed.
       return string_result_;
     case kReadAsBinaryString:
-      SetStringResult(raw_data_->ToString());
+      SetStringResult(String(static_cast<const char*>(raw_data_->Data()),
+                             static_cast<size_t>(bytes_loaded_)));
       break;
     case kReadAsText:
       SetStringResult(ConvertToText());
@@ -185,8 +185,7 @@ String FileReaderLoader::StringResult() {
 
   if (finished_loading_) {
     DCHECK(is_raw_data_converted_);
-    AdjustReportedMemoryUsageToV8(
-        -1 * static_cast<int64_t>(raw_data_->ByteLength()));
+    AdjustReportedMemoryUsageToV8(-1 * static_cast<int64_t>(bytes_loaded_));
     raw_data_.reset();
   }
   return string_result_;
@@ -240,13 +239,12 @@ void FileReaderLoader::OnStartLoading(uint64_t total_bytes) {
       return;
     }
 
-    raw_data_ = std::make_unique<ArrayBufferBuilder>(total_bytes);
-    if (!raw_data_->IsValid()) {
+    raw_data_ = ArrayBuffer::Create(static_cast<unsigned>(total_bytes), 1);
+    if (!raw_data_) {
       Failed(FileErrorCode::kNotReadableErr,
              FailureType::kArrayBufferBuilderCreation);
       return;
     }
-    raw_data_->SetVariableCapacity(false);
   }
 
   if (client_)
@@ -268,17 +266,23 @@ void FileReaderLoader::OnReceivedData(const char* data, unsigned data_length) {
     return;
   }
 
-  unsigned bytes_appended = raw_data_->Append(data, data_length);
-  if (!bytes_appended) {
+  // Receiving more data than expected would indicate a bug in the
+  // implementation of the mojom Blob interface. However there is no guarantee
+  // that the BlobPtr is actually backed by a "real" blob, so to defend against
+  // compromised renderer processes we still need to carefully validate anything
+  // received. So return an error if we received too much data.
+  if (bytes_loaded_ + data_length > raw_data_->ByteLength()) {
     raw_data_.reset();
     bytes_loaded_ = 0;
     Failed(FileErrorCode::kNotReadableErr,
            FailureType::kArrayBufferBuilderAppend);
     return;
   }
-  bytes_loaded_ += bytes_appended;
+  memcpy(static_cast<char*>(raw_data_->Data()) + bytes_loaded_, data,
+         data_length);
+  bytes_loaded_ += data_length;
   is_raw_data_converted_ = false;
-  AdjustReportedMemoryUsageToV8(bytes_appended);
+  AdjustReportedMemoryUsageToV8(data_length);
 
   if (client_)
     client_->DidReceiveData();
@@ -286,7 +290,7 @@ void FileReaderLoader::OnReceivedData(const char* data, unsigned data_length) {
 
 void FileReaderLoader::OnFinishLoading() {
   if (read_type_ != kReadByClient && raw_data_) {
-    raw_data_->ShrinkToFit();
+    DCHECK_EQ(bytes_loaded_, raw_data_->ByteLength());
     is_raw_data_converted_ = false;
   }
 
@@ -355,17 +359,18 @@ void FileReaderLoader::OnDataPipeReadable(MojoResult result) {
   while (true) {
     uint32_t num_bytes;
     const void* buffer;
-    MojoResult result = consumer_handle_->BeginReadData(
+    MojoResult pipe_result = consumer_handle_->BeginReadData(
         &buffer, &num_bytes, MOJO_READ_DATA_FLAG_NONE);
-    if (result == MOJO_RESULT_SHOULD_WAIT) {
+    if (pipe_result == MOJO_RESULT_SHOULD_WAIT) {
       if (!IsSyncLoad())
         return;
 
-      result = mojo::Wait(consumer_handle_.get(), MOJO_HANDLE_SIGNAL_READABLE);
-      if (result == MOJO_RESULT_OK)
+      pipe_result =
+          mojo::Wait(consumer_handle_.get(), MOJO_HANDLE_SIGNAL_READABLE);
+      if (pipe_result == MOJO_RESULT_OK)
         continue;
     }
-    if (result == MOJO_RESULT_FAILED_PRECONDITION) {
+    if (pipe_result == MOJO_RESULT_FAILED_PRECONDITION) {
       // Pipe closed.
       if (!received_all_data_) {
         Failed(FileErrorCode::kNotReadableErr,
@@ -373,7 +378,7 @@ void FileReaderLoader::OnDataPipeReadable(MojoResult result) {
       }
       return;
     }
-    if (result != MOJO_RESULT_OK) {
+    if (pipe_result != MOJO_RESULT_OK) {
       Failed(FileErrorCode::kNotReadableErr,
              FailureType::kMojoPipeUnexpectedReadError);
       return;
@@ -429,7 +434,7 @@ String FileReaderLoader::ConvertToText() {
         encoding_.IsValid() ? encoding_ : UTF8Encoding()));
   }
   builder.Append(decoder_->Decode(static_cast<const char*>(raw_data_->Data()),
-                                  raw_data_->ByteLength()));
+                                  static_cast<size_t>(bytes_loaded_)));
 
   if (finished_loading_)
     builder.Append(decoder_->Flush());
@@ -455,7 +460,7 @@ String FileReaderLoader::ConvertToDataURL() {
 
   Vector<char> out;
   Base64Encode(static_cast<const char*>(raw_data_->Data()),
-               raw_data_->ByteLength(), out);
+               static_cast<unsigned>(bytes_loaded_), out);
   out.push_back('\0');
   builder.Append(out.data());
 
diff --git a/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.h b/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.h
index 9f238c8732d..f486c798bc1 100644
--- a/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.h
+++ b/chromium/third_party/blink/renderer/core/fileapi/file_reader_loader.h
@@ -43,7 +43,7 @@
 #include "third_party/blink/renderer/platform/wtf/forward.h"
 #include "third_party/blink/renderer/platform/wtf/text/text_encoding.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
-#include "third_party/blink/renderer/platform/wtf/typed_arrays/array_buffer_builder.h"
+#include "third_party/blink/renderer/platform/wtf/typed_arrays/array_buffer.h"
 
 namespace blink {
 
@@ -75,9 +75,9 @@ class CORE_EXPORT FileReaderLoader : public mojom::blink::BlobReaderClient {
 
   // If client is given, do the loading asynchronously. Otherwise, load
   // synchronously.
-  static std::unique_ptr<FileReaderLoader> Create(ReadType,
-                                                  FileReaderLoaderClient*);
-  FileReaderLoader(ReadType, FileReaderLoaderClient*);
+  FileReaderLoader(ReadType,
+                   FileReaderLoaderClient*,
+                   scoped_refptr<base::SingleThreadTaskRunner>);
   ~FileReaderLoader() override;
 
   void Start(scoped_refptr<BlobDataHandle>);
@@ -154,7 +154,7 @@ class CORE_EXPORT FileReaderLoader : public mojom::blink::BlobReaderClient {
   WTF::TextEncoding encoding_;
   String data_type_;
 
-  std::unique_ptr<ArrayBufferBuilder> raw_data_;
+  scoped_refptr<ArrayBuffer> raw_data_;
   bool is_raw_data_converted_ = false;
 
   Persistent<DOMArrayBuffer> array_buffer_result_;
@@ -183,6 +183,8 @@ class CORE_EXPORT FileReaderLoader : public mojom::blink::BlobReaderClient {
   bool started_loading_ = false;
 #endif  // DCHECK_IS_ON()
 
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
+
   base::WeakPtrFactory<FileReaderLoader> weak_factory_;
 };
 
diff --git a/chromium/third_party/blink/renderer/core/fileapi/file_reader_sync.cc b/chromium/third_party/blink/renderer/core/fileapi/file_reader_sync.cc
index 4357025cfce..b011ab2af11 100644
--- a/chromium/third_party/blink/renderer/core/fileapi/file_reader_sync.cc
+++ b/chromium/third_party/blink/renderer/core/fileapi/file_reader_sync.cc
@@ -30,6 +30,8 @@
 
 #include "third_party/blink/renderer/core/fileapi/file_reader_sync.h"
 
+#include <memory>
+
 #include "third_party/blink/renderer/core/execution_context/execution_context.h"
 #include "third_party/blink/renderer/core/fileapi/blob.h"
 #include "third_party/blink/renderer/core/fileapi/file_error.h"
@@ -53,7 +55,8 @@ enum class WorkerType {
 };
 }  // namespace
 
-FileReaderSync::FileReaderSync(ExecutionContext* context) {
+FileReaderSync::FileReaderSync(ExecutionContext* context)
+    : task_runner_(context->GetTaskRunner(TaskType::kFileReading)) {
   WorkerType type = WorkerType::OTHER;
   if (context->IsDedicatedWorkerGlobalScope())
     type = WorkerType::DEDICATED_WORKER;
@@ -72,8 +75,8 @@ DOMArrayBuffer* FileReaderSync::readAsArrayBuffer(
     ExceptionState& exception_state) {
   DCHECK(blob);
 
-  std::unique_ptr<FileReaderLoader> loader =
-      FileReaderLoader::Create(FileReaderLoader::kReadAsArrayBuffer, nullptr);
+  std::unique_ptr<FileReaderLoader> loader = std::make_unique<FileReaderLoader>(
+      FileReaderLoader::kReadAsArrayBuffer, nullptr, task_runner_);
   StartLoading(*loader, *blob, exception_state);
 
   return loader->ArrayBufferResult();
@@ -83,8 +86,8 @@ String FileReaderSync::readAsBinaryString(Blob* blob,
                                           ExceptionState& exception_state) {
   DCHECK(blob);
 
-  std::unique_ptr<FileReaderLoader> loader =
-      FileReaderLoader::Create(FileReaderLoader::kReadAsBinaryString, nullptr);
+  std::unique_ptr<FileReaderLoader> loader = std::make_unique<FileReaderLoader>(
+      FileReaderLoader::kReadAsBinaryString, nullptr, task_runner_);
   StartLoading(*loader, *blob, exception_state);
   return loader->StringResult();
 }
@@ -94,8 +97,8 @@ String FileReaderSync::readAsText(Blob* blob,
                                   ExceptionState& exception_state) {
   DCHECK(blob);
 
-  std::unique_ptr<FileReaderLoader> loader =
-      FileReaderLoader::Create(FileReaderLoader::kReadAsText, nullptr);
+  std::unique_ptr<FileReaderLoader> loader = std::make_unique<FileReaderLoader>(
+      FileReaderLoader::kReadAsText, nullptr, task_runner_);
   loader->SetEncoding(encoding);
   StartLoading(*loader, *blob, exception_state);
   return loader->StringResult();
@@ -105,8 +108,8 @@ String FileReaderSync::readAsDataURL(Blob* blob,
                                      ExceptionState& exception_state) {
   DCHECK(blob);
 
-  std::unique_ptr<FileReaderLoader> loader =
-      FileReaderLoader::Create(FileReaderLoader::kReadAsDataURL, nullptr);
+  std::unique_ptr<FileReaderLoader> loader = std::make_unique<FileReaderLoader>(
+      FileReaderLoader::kReadAsDataURL, nullptr, task_runner_);
   loader->SetDataType(blob->type());
   StartLoading(*loader, *blob, exception_state);
   return loader->StringResult();
diff --git a/chromium/third_party/blink/renderer/core/fileapi/file_reader_sync.h b/chromium/third_party/blink/renderer/core/fileapi/file_reader_sync.h
index 2c93cb71614..5b313f5a1f3 100644
--- a/chromium/third_party/blink/renderer/core/fileapi/file_reader_sync.h
+++ b/chromium/third_party/blink/renderer/core/fileapi/file_reader_sync.h
@@ -35,6 +35,10 @@
 #include "third_party/blink/renderer/platform/heap/handle.h"
 #include "third_party/blink/renderer/platform/wtf/text/wtf_string.h"
 
+namespace base {
+class SingleThreadTaskRunner;
+}
+
 namespace blink {
 
 class Blob;
@@ -63,6 +67,8 @@ class FileReaderSync final : public ScriptWrappable {
 
  private:
   void StartLoading(FileReaderLoader&, const Blob&, ExceptionState&);
+
+  scoped_refptr<base::SingleThreadTaskRunner> task_runner_;
 };
 
 }  // namespace blink
diff --git a/chromium/third_party/blink/renderer/core/fileapi/public_url_manager.cc b/chromium/third_party/blink/renderer/core/fileapi/public_url_manager.cc
index e3de27cfe89..9794137d911 100644
--- a/chromium/third_party/blink/renderer/core/fileapi/public_url_manager.cc
+++ b/chromium/third_party/blink/renderer/core/fileapi/public_url_manager.cc
@@ -167,6 +167,9 @@ void PublicURLManager::Revoke(const KURL& url) {
 void PublicURLManager::Resolve(
     const KURL& url,
     network::mojom::blink::URLLoaderFactoryRequest factory_request) {
+  if (is_stopped_)
+    return;
+
   DCHECK(BlobUtils::MojoBlobURLsEnabled());
   DCHECK(url.ProtocolIs("blob"));
   if (!url_store_) {
@@ -179,6 +182,9 @@ void PublicURLManager::Resolve(
 void PublicURLManager::Resolve(
     const KURL& url,
     mojom::blink::BlobURLTokenRequest token_request) {
+  if (is_stopped_)
+    return;
+
   DCHECK(BlobUtils::MojoBlobURLsEnabled());
   DCHECK(url.ProtocolIs("blob"));
   if (!url_store_) {
diff --git a/chromium/third_party/blink/renderer/core/fileapi/public_url_manager.h b/chromium/third_party/blink/renderer/core/fileapi/public_url_manager.h
index 7c808b2dd83..a08d61aa43b 100644
--- a/chromium/third_party/blink/renderer/core/fileapi/public_url_manager.h
+++ b/chromium/third_party/blink/renderer/core/fileapi/public_url_manager.h
@@ -29,7 +29,7 @@
 #include "services/network/public/mojom/url_loader_factory.mojom-blink.h"
 #include "third_party/blink/public/mojom/blob/blob_url_store.mojom-blink.h"
 #include "third_party/blink/renderer/core/core_export.h"
-#include "third_party/blink/renderer/core/dom/context_lifecycle_observer.h"
+#include "third_party/blink/renderer/core/execution_context/context_lifecycle_observer.h"
 #include "third_party/blink/renderer/platform/heap/handle.h"
 #include "third_party/blink/renderer/platform/wtf/hash_map.h"
 #include "third_party/blink/renderer/platform/wtf/hash_set.h"