www/qt5-webengine: Address a few CVEs in chromium

MFH:		2024Q2
Security:	aa2b65e4-2f63-11ef-9cab-4ccc6adda413
(cherry picked from commit 0f4290c640f535b5fe7c9248c4c4ce7990ed4e1c)

2 files changed, 619 insertions, 0 deletions

diff --git a/www/qt5-webengine/Makefile b/www/qt5-webengine/Makefile
index 261a0f2559f3..9b1dbab6880c 100644
--- a/www/qt5-webengine/Makefile
+++ b/www/qt5-webengine/Makefile
@@ -19,6 +19,7 @@
 
 PORTNAME=	webengine
 DISTVERSION=	${QT5_VERSION}${QT5_KDE_PATCH}
+PORTREVISION=	1
 CATEGORIES=	www
 PKGNAMEPREFIX=	qt5-
 
diff --git a/www/qt5-webengine/files/patch-security-rollup b/www/qt5-webengine/files/patch-security-rollup
index e0554d3d7c61..b27b8cec77c9 100644
--- a/www/qt5-webengine/files/patch-security-rollup
+++ b/www/qt5-webengine/files/patch-security-rollup
@@ -5,6 +5,14 @@ Addresses the following security issues:
 - Security bug 329674887
 - CVE-2024-3157
 - CVE-2024-3516
+- CVE-2024-3839
+- CVE-2024-3837
+- Security bug 40940917
+- CVE-2024-4058
+- Security bug 327698060
+- CVE-2024-4558
+- CVE-2024-3914
+- Security bug 329699609
 
 From a3580d0a0fc78016093fd96d72f1449589642292 Mon Sep 17 00:00:00 2001
 From: Marco Paniconi <marpan@google.com>
@@ -271,3 +279,613 @@ index 84a0c8fd9e0d..3e8a4a71ff67 100644
          }
  
          const TQualifier qualifier = fieldType->getQualifier();
+From 2c61d151bd3fab48c7e03a4cbfca22fa09c9022c Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Dominik=20R=C3=B6ttsches?= <drott@chromium.org>
+Date: Thu, 14 Mar 2024 12:48:18 +0000
+Subject: [PATCH] [Backport] CVE-2024-3839: Out of bounds read in Fonts
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Cherry-pick of patch originally reviewed on
+https://chromium-review.googlesource.com/c/chromium/src/+/5361874:
+Disable STAT sanitization/checks through OTS
+
+Due to issues in upstream, OTS STAT sanitization does not provide an
+added security benefit. Pass-through the STAT table.
+
+Bug: chromium:41491859
+Change-Id: I19dcd87376af553afe242452396b951a74691f3c
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5361874
+Commit-Queue: Dominik Röttsches <drott@chromium.org>
+Reviewed-by: Koji Ishii <kojii@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1272710}
+Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/560661
+Reviewed-by: Michal Klocek <michal.klocek@qt.io>
+---
+ .../blink/renderer/platform/fonts/web_font_decoder.cc           | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/chromium/third_party/blink/renderer/platform/fonts/web_font_decoder.cc b/chromium/third_party/blink/renderer/platform/fonts/web_font_decoder.cc
+index e72f801016a3..dfae30c22c22 100644
+--- src/3rdparty/chromium/third_party/blink/renderer/platform/fonts/web_font_decoder.cc
++++ src/3rdparty/chromium/third_party/blink/renderer/platform/fonts/web_font_decoder.cc
+@@ -97,6 +97,7 @@ ots::TableAction BlinkOTSContext::GetTableAction(uint32_t tag) {
+   const uint32_t kCpalTag = OTS_TAG('C', 'P', 'A', 'L');
+   const uint32_t kCff2Tag = OTS_TAG('C', 'F', 'F', '2');
+   const uint32_t kSbixTag = OTS_TAG('s', 'b', 'i', 'x');
++  const uint32_t kStatTag = OTS_TAG('S', 'T', 'A', 'T');
+ #if HB_VERSION_ATLEAST(1, 0, 0)
+   const uint32_t kGdefTag = OTS_TAG('G', 'D', 'E', 'F');
+   const uint32_t kGposTag = OTS_TAG('G', 'P', 'O', 'S');
+@@ -123,6 +124,7 @@ ots::TableAction BlinkOTSContext::GetTableAction(uint32_t tag) {
+     case kCpalTag:
+     case kCff2Tag:
+     case kSbixTag:
++    case kStatTag:
+ #if HB_VERSION_ATLEAST(1, 0, 0)
+     // Let HarfBuzz handle how to deal with broken tables.
+     case kAvarTag:
+From 0594d0383b46e78d33fde62258ffb49b53d3c429 Mon Sep 17 00:00:00 2001
+From: Liza Burakova <liza@chromium.org>
+Date: Wed, 21 Feb 2024 19:02:15 +0000
+Subject: [PATCH] [Backport] CVE-2024-3837: Use after free in QUIC
+
+Manual cherry-pick of patch originally reviewed on
+https://chromium-review.googlesource.com/c/chromium/src/+/5268864:
+Check if session is going away in Handle::RequestStream.
+
+This CL adds an extra check in the QuicChromiumClientSession
+handle's RequestSession to make sure the session is not
+marked as going away before creating a new StreamRequest.
+
+Bug: 41491379
+Change-Id: I687dfc23131871cdba345d3cf78dbbbd2e619ce9
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5268864
+Reviewed-by: Kenichi Ishibashi <bashi@chromium.org>
+Commit-Queue: Liza Burakova <liza@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1263483}
+Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/560662
+Reviewed-by: Michal Klocek <michal.klocek@qt.io>
+---
+ chromium/net/quic/quic_chromium_client_session.cc | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/chromium/net/quic/quic_chromium_client_session.cc b/chromium/net/quic/quic_chromium_client_session.cc
+index 6e08826bbb0d..4bca38bd10db 100644
+--- src/3rdparty/chromium/net/quic/quic_chromium_client_session.cc
++++ src/3rdparty/chromium/net/quic/quic_chromium_client_session.cc
+@@ -500,7 +500,8 @@ int QuicChromiumClientSession::Handle::RequestStream(
+     const NetworkTrafficAnnotationTag& traffic_annotation) {
+   DCHECK(!stream_request_);
+ 
+-  if (!session_)
++  // TODO(crbug.com/41491379): Add a regression test.
++  if (!session_ || session_->going_away_)
+     return ERR_CONNECTION_CLOSED;
+ 
+   requires_confirmation |= session_->gquic_zero_rtt_disabled();
+From 28c3af39d3bdaea88865f901d19862bf7d44199d Mon Sep 17 00:00:00 2001
+From: Pete Williamson <petewil@chromium.org>
+Date: Tue, 27 Feb 2024 00:19:05 +0000
+Subject: [PATCH] [Backport] Security bug 40940917
+
+Cherry-pick of patch originally reviewed on
+https://chromium-review.googlesource.com/c/chromium/src/+/5293726:
+Fix misalligned address in hunspell::NodeReader::ReaderForLookupAt
+
+With the Hunspell spell checking library, we are using a custom wrapper
+to read the dictionaries from files.  In that custom wrapper, we were
+reading by using reinterpret_cast to interpret an offset into a pointer,
+and then reading the bytes at that pointer for the child_offset.
+
+The spell checking code appears to have been working properly in the
+field.  However, the current code caused fuzzing test failures, and
+those failures are blocking other tests, so we need to fix this to
+unblock other tests.
+
+It turns out that we were casting a value to a pointer that did not
+have proper alignment (for instance, a pointer to a 32 bit int needs
+to be 4 byte allinged, but this pointer was not). While it has often
+worked in older compilers, it turns out this is undefined behavior.
+
+Instead of relying on undefined behavior, the right thing to do is to
+use std::memcpy to copy the bytes from the misalligned address into
+their final destination (either an int32 or an int16 in this case).
+
+Bug: 40940917
+Change-Id: I8aeba9ee8000b51e98863813235d8dceb1c41ceb
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5293726
+Commit-Queue: Peter Williamson <petewil@chromium.org>
+Reviewed-by: Trevor Perrier <perrier@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1265552}
+Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/560663
+Reviewed-by: Michal Klocek <michal.klocek@qt.io>
+---
+ .../hunspell/google/bdict_reader.cc           | 27 ++++++++++++++-----
+ 1 file changed, 21 insertions(+), 6 deletions(-)
+
+diff --git a/chromium/third_party/hunspell/google/bdict_reader.cc b/chromium/third_party/hunspell/google/bdict_reader.cc
+index 70416a7c9048..70e4d4977ad5 100644
+--- src/3rdparty/chromium/third_party/hunspell/google/bdict_reader.cc
++++ src/3rdparty/chromium/third_party/hunspell/google/bdict_reader.cc
+@@ -5,6 +5,8 @@
+ #include "third_party/hunspell/google/bdict_reader.h"
+ 
+ #include <stdint.h>
++#include <cstdint>
++#include <cstring>
+ 
+ #include "base/check.h"
+ 
+@@ -413,19 +415,32 @@ NodeReader::FindResult NodeReader::ReaderForLookupAt(
+   if (index >= static_cast<size_t>(lookup_num_chars()) || !is_valid_)
+     return FIND_DONE;
+ 
+-  size_t child_offset;
++  size_t child_offset = 0;
+   if (is_lookup_32()) {
+     // Table contains 32-bit absolute offsets.
+-    child_offset =
+-        reinterpret_cast<const unsigned int*>(table_begin)[index];
++
++    // We need to use memcpy here instead of just casting the offset into a
++    // pointer to an int because the cast can cause undefined behavior if
++    // the pointer is not alligned, and in this case it is not.
++    int byte_offset = index * sizeof(uint32_t);
++    std::memcpy(&child_offset,
++                reinterpret_cast<const void*>(table_begin + byte_offset),
++                sizeof(uint32_t));
+     if (!child_offset)
+       return FIND_NOTHING;  // This entry in the table is empty.
+   } else {
+     // Table contains 16-bit offsets relative to the current node.
+-    child_offset =
+-        reinterpret_cast<const unsigned short*>(table_begin)[index];
+-    if (!child_offset)
++
++    // We need to use memcpy here instead of just casting the offset into a
++    // pointer to an int because the cast can cause undefined behavior if
++    // the pointer is not alligned, and in this case it is not.
++    int byte_offset = index * sizeof(uint16_t);
++    std::memcpy(&child_offset,
++                reinterpret_cast<const void*>(table_begin + byte_offset),
++                sizeof(uint16_t));
++    if (!child_offset) {
+       return FIND_NOTHING;  // This entry in the table is empty.
++    }
+     child_offset += node_offset_;
+   }
+ 
+From b4d43a76e4c334084400402c09620ef24870704e Mon Sep 17 00:00:00 2001
+From: Shahbaz Youssefi <syoussefi@chromium.org>
+Date: Mon, 8 Apr 2024 10:14:45 -0400
+Subject: [PATCH] [Backport] CVE-2024-4058: Type Confusion in ANGLE
+
+Partial manual cherry-pick of patch originally reviewed on
+https://chromium-review.googlesource.com/c/angle/angle/+/5466390:
+SPIR-V: Fix const constructors with single scalar
+
+These constructors may be generated because of
+RemoveArrayLengthTraverser.
+
+Bug: chromium:332546345
+Change-Id: I2b2bf3728ef5bae148abc2a8518f8f3f42850025
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5462388
+(cherry picked from commit 0b776d32f69a932acb61963d9daad9e13f610944)
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5466390
+Commit-Queue: Zakhar Voit <voit@google.com>
+Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org>
+Reviewed-by: Geoff Lang <geofflang@chromium.org>
+Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/560664
+Reviewed-by: Michal Klocek <michal.klocek@qt.io>
+---
+ .../third_party/angle/src/compiler/translator/Compiler.cpp   | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/chromium/third_party/angle/src/compiler/translator/Compiler.cpp b/chromium/third_party/angle/src/compiler/translator/Compiler.cpp
+index 27975887086a..435d3b41b3a3 100644
+--- src/3rdparty/chromium/third_party/angle/src/compiler/translator/Compiler.cpp
++++ src/3rdparty/chromium/third_party/angle/src/compiler/translator/Compiler.cpp
+@@ -757,6 +757,11 @@ bool TCompiler::checkAndSimplifyAST(TIntermBlock *root,
+     {
+         return false;
+     }
++    // Fold the expressions again, because |RemoveArrayLengthMethod| can introduce new constants.
++    if (!FoldExpressions(this, root, &mDiagnostics))
++    {
++        return false;
++    }
+ 
+     if (!RemoveUnreferencedVariables(this, root, &mSymbolTable))
+     {
+From dceba69334080559303f92fc4a6c6d01e7dcd00c Mon Sep 17 00:00:00 2001
+From: Brendon Tiszka <tiszka@chromium.org>
+Date: Sun, 3 Mar 2024 21:30:59 +0100
+Subject: [PATCH] [Backport] Security bug 327698060
+
+Manual cherry-pick of patch originally reviewed on
+https://chromium-review.googlesource.com/c/chromium/src/+/5337387:
+PaintOpReader: Harden PaintImage deserialization
+
+Add missing validity check after `Read`
+
+Bug: 327698060
+Change-Id: I0aa5120296009998af3235a01304a1f597a82a33
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5337387
+Commit-Queue: Khushal Sagar <khushalsagar@chromium.org>
+Reviewed-by: Khushal Sagar <khushalsagar@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1267636}
+Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/560665
+Reviewed-by: Michal Klocek <michal.klocek@qt.io>
+Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
+---
+ chromium/cc/paint/paint_op_reader.cc | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/chromium/cc/paint/paint_op_reader.cc b/chromium/cc/paint/paint_op_reader.cc
+index 0979f6630175..b6a9d8ca3641 100644
+--- src/3rdparty/chromium/cc/paint/paint_op_reader.cc
++++ src/3rdparty/chromium/cc/paint/paint_op_reader.cc
+@@ -309,6 +309,10 @@ void PaintOpReader::Read(PaintImage* image) {
+       case PaintOp::SerializedImageType::kImageData: {
+         SkColorType color_type;
+         Read(&color_type);
++        if (!valid_) {
++          return;
++        }
++
+         uint32_t width;
+         Read(&width);
+         uint32_t height;
+From 2b188075ed5f01cc9c09b5273b5e6177d7252a0e Mon Sep 17 00:00:00 2001
+From: Geoff Lang <geofflang@chromium.org>
+Date: Mon, 29 Apr 2024 15:27:36 -0400
+Subject: [PATCH] [Backport] CVE-2024-4558: Use after free in ANGLE
+
+Manual cherry-pick of patch originally reviewed on
+https://chromium-review.googlesource.com/c/angle/angle/+/5498735:
+GL: Sync unpack state for glCompressedTexSubImage3D
+
+Unpack state is supposed to be ignored for compressed tex image calls
+but some drivers use it anyways and read incorrect data.
+
+Texture3DTestES3.PixelUnpackStateTexSubImage covers this case.
+
+Bug: chromium:337766133
+Change-Id: Ic11a056113b1850bd5b4d6840527164a12849a22
+Reviewed-on: https://chromium-review.googlesource.com/c/angle/angle/+/5498735
+Commit-Queue: Shahbaz Youssefi <syoussefi@chromium.org>
+
+Reviewed-by: Shahbaz Youssefi <syoussefi@chromium.org>
+Change-Id: I0736ceb1e3165f571358ae06a0287b3f5a98d425
+Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/560666
+Reviewed-by: Michal Klocek <michal.klocek@qt.io>
+---
+ .../third_party/angle/src/libANGLE/renderer/gl/TextureGL.cpp     | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/chromium/third_party/angle/src/libANGLE/renderer/gl/TextureGL.cpp b/chromium/third_party/angle/src/libANGLE/renderer/gl/TextureGL.cpp
+index 035d4520b13b..0cfd21621bb3 100644
+--- src/3rdparty/chromium/third_party/angle/src/libANGLE/renderer/gl/TextureGL.cpp
++++ src/3rdparty/chromium/third_party/angle/src/libANGLE/renderer/gl/TextureGL.cpp
+@@ -579,6 +579,7 @@ angle::Result TextureGL::setCompressedSubImage(const gl::Context *context,
+         nativegl::GetCompressedSubTexImageFormat(functions, features, format);
+ 
+     stateManager->bindTexture(getType(), mTextureID);
++    ANGLE_TRY(stateManager->setPixelUnpackState(context, unpack));
+     if (nativegl::UseTexImage2D(getType()))
+     {
+         ASSERT(area.z == 0 && area.depth == 1);
+From d553c9366aedad5701852427f8e1910381c4ff8b Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marja=20H=C3=B6ltt=C3=A4?= <marja@google.com>
+Date: Tue, 26 Mar 2024 13:53:21 +0000
+Subject: [PATCH] [Backport] CVE-2024-3914: Use after free in V8 (1/2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Manual backport of patch originally reviewed on
+https://chromium-review.googlesource.com/c/chromium/src/+/5387887:
+[M120-LTS] Fix DOMArrayBuffer::IsDetached()
+
+M120 merge issues:
+  third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc:
+    - Conflicting types for variable worlds
+    - Conflicting AllWorldsInIsolate() call (M120 doesn't use the last argument)
+
+A DOMArrayBuffer was maintaining its own "is_detached_" state, and
+would consider itself non-detached even if the corresponding
+JSArrayBuffer (or, all of them, in case there are several) was
+detached.
+
+Piping in the v8::Isolate would be a too big change for this fix, so this is using v8::Isolate::GetCurrent() for now.
+
+Bug: 330759272
+Change-Id: I1e98ebd2066d2e59658db12f1bb419b6ebc1d706
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5387887
+Commit-Queue: Marja Hölttä <marja@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1278283}
+Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/562706
+Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
+---
+ .../core/typed_arrays/dom_array_buffer.cc     | 50 +++++++++++++++++++
+ .../core/typed_arrays/dom_array_buffer.h      | 13 +++++
+ .../core/typed_arrays/dom_array_buffer_base.h |  2 +-
+ 3 files changed, 64 insertions(+), 1 deletion(-)
+
+diff --git a/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc b/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc
+index c456d15f2f50..38dcd3a35737 100644
+--- src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc
++++ src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc
+@@ -18,6 +18,15 @@ static void AccumulateArrayBuffersForAllWorlds(
+     v8::Isolate* isolate,
+     DOMArrayBuffer* object,
+     Vector<v8::Local<v8::ArrayBuffer>, 4>& buffers) {
++  if (!object->has_non_main_world_wrappers() && IsMainThread()) {
++    const DOMWrapperWorld& world = DOMWrapperWorld::MainWorld();
++    v8::Local<v8::Object> wrapper = world.DomDataStore().Get(object, isolate);
++    if (!wrapper.IsEmpty()) {
++      buffers.push_back(v8::Local<v8::ArrayBuffer>::Cast(wrapper));
++    }
++    return;
++  }
++
+   Vector<scoped_refptr<DOMWrapperWorld>> worlds;
+   DOMWrapperWorld::AllWorldsInCurrentThread(worlds);
+   for (const auto& world : worlds) {
+@@ -155,6 +164,47 @@ DOMArrayBuffer* DOMArrayBuffer::Create(
+   return Create(std::move(contents));
+ }
+ 
++bool DOMArrayBuffer::IsDetached() const {
++  if (contents_.BackingStore() == nullptr) {
++    return is_detached_;
++  }
++  if (is_detached_) {
++    return true;
++  }
++
++  v8::Isolate* isolate = v8::Isolate::GetCurrent();
++  v8::HandleScope handle_scope(isolate);
++  Vector<v8::Local<v8::ArrayBuffer>, 4> buffer_handles;
++  AccumulateArrayBuffersForAllWorlds(isolate, const_cast<DOMArrayBuffer*>(this),  buffer_handles);
++
++  // There may be several v8::ArrayBuffers corresponding to the DOMArrayBuffer,
++  // but at most one of them may be non-detached.
++  int nondetached_count = 0;
++  int detached_count = 0;
++
++  for (const auto& buffer_handle : buffer_handles) {
++    if (buffer_handle->WasDetached()) {
++      ++detached_count;
++    } else {
++      ++nondetached_count;
++    }
++  }
++  CHECK_LE(nondetached_count, 1);
++
++  return nondetached_count == 0 && detached_count > 0;
++}
++
++v8::Local<v8::Object> DOMArrayBuffer::AssociateWithWrapper(
++    v8::Isolate* isolate,
++    const WrapperTypeInfo* wrapper_type_info,
++    v8::Local<v8::Object> wrapper) {
++  if (!DOMWrapperWorld::Current(isolate).IsMainWorld()) {
++    has_non_main_world_wrappers_ = true;
++  }
++  return ScriptWrappable::AssociateWithWrapper(isolate, wrapper_type_info,
++                                               wrapper);
++}
++
+ DOMArrayBuffer* DOMArrayBuffer::Slice(size_t begin, size_t end) const {
+   begin = std::min(begin, ByteLengthAsSizeT());
+   end = std::min(end, ByteLengthAsSizeT());
+diff --git a/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h b/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h
+index e9a85d38d4d4..b1820dfa8408 100644
+--- src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h
++++ src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h
+@@ -79,8 +79,21 @@ class CORE_EXPORT DOMArrayBuffer final : public DOMArrayBufferBase {
+   v8::Local<v8::Value> Wrap(v8::Isolate*,
+                             v8::Local<v8::Object> creation_context) override;
+ 
++  bool IsDetached() const override;
++
++  v8::Local<v8::Object> AssociateWithWrapper(
++      v8::Isolate* isolate,
++      const WrapperTypeInfo* wrapper_type_info,
++      v8::Local<v8::Object> wrapper) override;
++
++  bool has_non_main_world_wrappers() const {
++    return has_non_main_world_wrappers_;
++  }
++
+  private:
+   bool TransferDetachable(v8::Isolate*, ArrayBufferContents& result);
++
++  bool has_non_main_world_wrappers_ = false;
+ };
+ 
+ }  // namespace blink
+diff --git a/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer_base.h b/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer_base.h
+index e99cce60dd7f..3ae9a4360e85 100644
+--- src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer_base.h
++++ src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer_base.h
+@@ -33,7 +33,7 @@ class CORE_EXPORT DOMArrayBufferBase : public ScriptWrappable {
+     return base::checked_cast<unsigned>(contents_.DataLength());
+   }
+ 
+-  bool IsDetached() const { return is_detached_; }
++  virtual bool IsDetached() const { return is_detached_; }
+ 
+   void Detach() { is_detached_ = true; }
+ 
+From efda8125f55049957e196995dffafb6dc171eadf Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Marja=20H=C3=B6ltt=C3=A4?= <marja@google.com>
+Date: Thu, 4 Apr 2024 09:43:42 +0200
+Subject: [PATCH] [Backport] CVE-2024-3914: Use after free in V8 (2/2)
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Manual cherry-pick of patch originally reviewed on
+https://chromium-review.googlesource.com/c/chromium/src/+/5419329:
+[M120-LTS] Comment out a CHECK that a DOMAB has maximally one non-detached JSAB
+
+Based on crash reports, this assumption is not true and has to be
+investigated.
+
+Removing this newly introduced CHECK to be able to merge fixes in this
+area - we still violate this invariant but the fixes are a step into
+the right direction.
+
+Fix in question:
+https://chromium-review.googlesource.com/5387887
+which also introduced this CHECK.
+
+Bug: 330759272
+Change-Id: I4ba52fee7ed8f45e352efd347e87df03d896ac3d
+Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5419329
+Commit-Queue: Marja Hölttä <marja@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#1282379}
+Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/562707
+Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
+---
+ .../blink/renderer/core/typed_arrays/dom_array_buffer.cc    | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc b/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc
+index 38dcd3a3573..69e332272dd 100644
+--- src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc
++++ src/3rdparty/chromium/third_party/blink/renderer/core/typed_arrays/dom_array_buffer.cc
+@@ -189,7 +189,11 @@ bool DOMArrayBuffer::IsDetached() const {
+       ++nondetached_count;
+     }
+   }
+-  CHECK_LE(nondetached_count, 1);
++  // This CHECK fires even though it should not. TODO(330759272): Investigate
++  // under which conditions we end up with multiple non-detached JSABs for the
++  // same DOMAB and potentially restore this check.
++
++  // CHECK_LE(nondetached_count, 1);
+ 
+   return nondetached_count == 0 && detached_count > 0;
+ }
+From 91b3c705d739f6b6c58da6133e8e818e06dfcaa3 Mon Sep 17 00:00:00 2001
+From: Victor Gomes <victorgomes@chromium.org>
+Date: Thu, 21 Mar 2024 09:59:19 +0100
+Subject: [PATCH] [Backport] Security bug 329699609
+
+Manual backport of patch originally reviewed on
+https://chromium-review.googlesource.com/c/v8/v8/+/5378286:
+Deal with large strings in NoSideEffectsErrorToString
+
+If name is too big, StringBuilder will fail to even add
+"<a very large string>" suffix.
+
+In this case, we truncate name first.
+
+Bug: 329699609
+Change-Id: I6e4440c07eae84371f44b54f88127e2c70af0db5
+Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/5378286
+Commit-Queue: Victor Gomes <victorgomes@chromium.org>
+Reviewed-by: Patrick Thier <pthier@chromium.org>
+Auto-Submit: Victor Gomes <victorgomes@chromium.org>
+Cr-Commit-Position: refs/heads/main@{#92932}
+Reviewed-on: https://codereview.qt-project.org/c/qt/qtwebengine-chromium/+/562708
+Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
+---
+ chromium/v8/src/objects/objects.cc | 25 +++++++++++++++++++------
+ 1 file changed, 19 insertions(+), 6 deletions(-)
+
+diff --git a/chromium/v8/src/objects/objects.cc b/chromium/v8/src/objects/objects.cc
+index 7b38609e347..7820c7e8e58 100644
+--- src/3rdparty/chromium/v8/src/objects/objects.cc
++++ src/3rdparty/chromium/v8/src/objects/objects.cc
+@@ -425,14 +425,27 @@ Handle<String> NoSideEffectsErrorToString(Isolate* isolate,
+   if (name_str->length() == 0) return msg_str;
+   if (msg_str->length() == 0) return name_str;
+ 
+-  IncrementalStringBuilder builder(isolate);
+-  builder.AppendString(name_str);
+-  builder.AppendCString(": ");
++  constexpr const char error_suffix[] = "<a very large string>";
++  constexpr int error_suffix_size = sizeof(error_suffix);
++  int suffix_size = std::min(error_suffix_size, msg_str->length());
+ 
+-  if (builder.Length() + msg_str->length() <= String::kMaxLength) {
+-    builder.AppendString(msg_str);
++  IncrementalStringBuilder builder(isolate);
++  if (name_str->length() + suffix_size + 2 /* ": " */ > String::kMaxLength) {
++    constexpr const char connector[] = "... : ";
++    int connector_size = sizeof(connector);
++    Handle<String> truncated_name = isolate->factory()->NewProperSubString(
++        name_str, 0, name_str->length() - error_suffix_size - connector_size);
++    builder.AppendString(truncated_name);
++    builder.AppendCString(connector);
++    builder.AppendCString(error_suffix);
+   } else {
+-    builder.AppendCString("<a very large string>");
++    builder.AppendString(name_str);
++    builder.AppendCString(": ");
++    if (builder.Length() + msg_str->length() <= String::kMaxLength) {
++      builder.AppendString(msg_str);
++    } else {
++      builder.AppendCString(error_suffix);
++    }
+   }
+ 
+   return builder.Finish().ToHandleChecked();
+From d3cb500c1d4b0508f3f21bb568c095984c614fcf Mon Sep 17 00:00:00 2001
+From: "Jason E. Hale" <jhale@FreeBSD.org>
+Date: Thu, 20 Jun 2024 23:42:33 -0400
+Subject: [PATCH] [Backport] Fixup CVE-2024-3914: Use after free in V8 (1/2)
+
+Manual backport of requisite method WasDetached() in V8.
+---
+ chromium/v8/include/v8.h   | 8 ++++++++
+ chromium/v8/src/api/api.cc | 4 ++++
+ 2 files changed, 12 insertions(+)
+
+diff --git a/chromium/v8/include/v8.h b/chromium/v8/include/v8.h
+index 32687d90b5f..8a1b437bb06 100644
+--- src/3rdparty/chromium/v8/include/v8.h
++++ src/3rdparty/chromium/v8/include/v8.h
+@@ -5299,6 +5299,11 @@ class V8_EXPORT ArrayBuffer : public Object {
+    */
+   bool IsDetachable() const;
+ 
++  /**
++   * Returns true if this ArrayBuffer has been detached.
++   */
++  bool WasDetached() const;
++
+   /**
+    * Detaches this ArrayBuffer and all its views (typed arrays).
+    * Detaching sets the byte length of the buffer and all typed arrays to zero,
+@@ -5349,6 +5354,9 @@ class V8_EXPORT ArrayBuffer : public Object {
+    * should not attempt to manage lifetime of the storage through other means.
+    *
+    * This function replaces both Externalize() and GetContents().
++   *
++   * The returned shared pointer will not be empty, even if the ArrayBuffer has
++   * been detached. Use |WasDetached| to tell if it has been detached instead.
+    */
+   std::shared_ptr<BackingStore> GetBackingStore();
+ 
+diff --git a/chromium/v8/src/api/api.cc b/chromium/v8/src/api/api.cc
+index b6f9d12769e..05d31a7cedf 100644
+--- src/3rdparty/chromium/v8/src/api/api.cc
++++ src/3rdparty/chromium/v8/src/api/api.cc
+@@ -7386,6 +7386,10 @@ bool v8::ArrayBuffer::IsDetachable() const {
+   return Utils::OpenHandle(this)->is_detachable();
+ }
+ 
++bool v8::ArrayBuffer::WasDetached() const {
++  return Utils::OpenHandle(this)->was_detached();
++}
++
+ namespace {
+ // The backing store deleter just deletes the indirection, which downrefs
+ // the shared pointer. It will get collected normally.