M130 stage 3

arm/build/config/compiler/BUILD.gn

@@ -2232,6 +2232,9 @@ config("no_chromium_code") {
       # third-party libraries.
       "-Wno-c++11-narrowing",
     ]
+    if (is_full_optimization_build) {
+      cflags += [ "-Xclang", "-O3" ]
+    }
     if (!is_nacl) {
       cflags += [
         # Disabled for similar reasons as -Wunused-variable.

other/thor_ver_linux/wrapper-raspi

@@ -0,0 +1,130 @@
+#!/bin/bash
+#
+# Copyright 2024 The Chromium Authors, the AUR, and Alex313031
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Let the wrapped binary know that it has been run through the wrapper.
+export CHROME_WRAPPER="`readlink -f "$0"`"
+
+HERE="`dirname "$CHROME_WRAPPER"`"
+
+# We include some xdg utilities next to the binary, and we want to prefer them
+# over the system versions when we know the system versions are very old. We
+# detect whether the system xdg utilities are sufficiently new to be likely to
+# work for us by looking for xdg-settings. If we find it, we leave $PATH alone,
+# so that the system xdg utilities (including any distro patches) will be used.
+if ! command -v xdg-settings &> /dev/null; then
+  # Old xdg utilities. Prepend $HERE to $PATH to use ours instead.
+  export PATH="$HERE:$PATH"
+else
+  # Use system xdg utilities. But first create mimeapps.list if it doesn't
+  # exist; some systems have bugs in xdg-mime that make it fail without it.
+  xdg_app_dir="${XDG_DATA_HOME:-$HOME/.local/share/applications}"
+  mkdir -p "$xdg_app_dir"
+  [ -f "$xdg_app_dir/mimeapps.list" ] || touch "$xdg_app_dir/mimeapps.list"
+fi
+
+# Always use our versions of ffmpeg libs.
+# This also makes RPMs find the compatibly-named library symlinks.
+if [[ -n "$LD_LIBRARY_PATH" ]]; then
+  LD_LIBRARY_PATH="$HERE/lib:$LD_LIBRARY_PATH"
+else
+  LD_LIBRARY_PATH="$HERE/lib"
+fi
+export LD_LIBRARY_PATH
+
+# Clean up old crash reports (see https://bugs.debian.org/1015931)
+# after 30 days.
+find "$HOME/.config/thorium/Crash Reports/pending/" -mtime +30 \
+  \( -name "*.meta" -o -name "*.dmp" \) -exec rm \{\} \;
+
+# APPNAME for GTK.
+APPNAME=thorium
+
+# Set DESKTOP variable
+# DESKTOP="thorium-browser"
+
+# Set XDG Title variable
+TITLE="Thorium Browser"
+
+# Set the correct file name for the desktop file
+export CHROME_DESKTOP="thorium-browser.desktop"
+
+# Set CHROME_VERSION_EXTRA text, which is displayed in the About dialog on chrome://help
+# DIST=`cat /etc/debian_version`
+export CHROME_VERSION_EXTRA="@@CHANNEL@@, built on Ubuntu (arm64)"
+
+# We don't want bug-buddy intercepting our crashes. http://crbug.com/24120
+export GNOME_DISABLE_CRASH_DIALOG=SET_BY_THORIUM
+
+# Set config home.
+XDG_CONFIG_HOME=${XDG_CONFIG_HOME:-~/.config}
+
+usage () {
+  echo "thorium-browser [-h|--help] [--temp-profile] [options] [URL]"
+  echo
+  echo "        -h, -help, or --help       This help screen"
+  echo "        --temp-profile             Start with a new and temporary profile"
+  echo "        --safe-mode                Disable all chrome://flags flags"
+  echo
+  echo " Other supported options are:"
+  MANWIDTH=80 man thorium-browser | sed -e '1,/OPTIONS/d; /ENVIRONMENT/,$d'
+  echo " See 'man thorium-browser' for more details"
+}
+
+want_temp_profile=0
+is_safe_mode=0
+while [ $# -gt 0 ]; do
+  case "$1" in
+    -h | --h | -help | --help )
+      usage
+      exit 0 ;;
+    --temp-profile )
+      want_temp_profile=1
+      shift ;;
+    --safe-mode )
+      is_safe_mode=1
+      shift ;;
+    -- ) # Stop option processing
+      shift
+      break ;;
+    * ) # Else
+      break ;;
+  esac
+done
+
+# Allow users to override command-line options with a file.
+if [[ -f $XDG_CONFIG_HOME/thorium/thorium-flags.conf ]]; then
+   CHROME_USER_FLAGS="$(cat $XDG_CONFIG_HOME/thorium/thorium-flags.conf)"
+fi
+
+# Sanitize std{in,out,err} because they'll be shared with untrusted child
+# processes (http://crbug.com/376567).
+exec < /dev/null
+exec > >(exec cat)
+exec 2> >(exec cat >&2)
+
+if [ $want_temp_profile -eq 1 ] ; then
+  TEMP_PROFILE=`mktemp -d`
+  echo "Using temporary profile: $TEMP_PROFILE"
+  PROFILE="$TEMP_PROFILE"
+  CACHE="$TEMP_PROFILE/cache"
+  export PROFILE
+  export CACHE
+  CHROME_USER_FLAGS="$CHROME_USER_FLAGS --user-data-dir=$TEMP_PROFILE --disk-cache-dir=$CACHE"
+else
+  PROFILE="$XDG_CONFIG_HOME/thorium"
+  CACHE="$XDG_CONFIG_HOME/thorium"
+  export PROFILE
+  export CACHE
+  CHROME_USER_FLAGS="$CHROME_USER_FLAGS"
+fi
+
+if [ $is_safe_mode -eq 1 ] ; then
+  CHROME_USER_FLAGS="$CHROME_USER_FLAGS --no-experiments"
+fi
+
+# Launch Thorium
+# Note: exec -a below is a bashism.
+exec -a "$0" "$HERE/@@PROGNAME@@" "$CHROME_USER_FLAGS" "$@"

other/thorium-2024-ui.patch

@@ -1651,7 +1651,7 @@ new file mode 100644
 index 0000000000000..04703d70ecf9b
 --- /dev/null
 +++ b/chrome/browser/ui/views/frame/window_caption_util.cc
-@@ -0,0 +1,24 @@
+@@ -0,0 +1,26 @@
 +// Copyright 2024 The Chromium Authors and Alex313031
 +// Use of this source code is governed by a BSD-style license that can be
 +// found in the LICENSE file.
@@ -1670,8 +1670,10 @@ index 0000000000000..04703d70ecf9b
 +      base::CommandLine::ForCurrentProcess()->HasSwitch("remove-tabsearch-button");
 +  static const bool disable_caption_button =
 +      base::CommandLine::ForCurrentProcess()->HasSwitch("disable-caption-button");
++  static const bool left_aligned_tab_search_button =
++      base::CommandLine::ForCurrentProcess()->HasSwitch("left-aligned-tab-search-button");
 +  return features::IsThorium2024() && browser->is_type_normal() &&
-+      !remove_tabsearch_button && !disable_caption_button;
++      !remove_tabsearch_button && !disable_caption_button && !left_aligned_tab_search_button;
 +#else
 +  return false;
 +#endif  // BUILDFLAG(IS_WIN)

setup.sh

@@ -173,6 +173,7 @@ copyRaspi () {
 	cp -r -v arm/build/* ${CR_SRC_DIR}/build/ &&
 	cp -r -v arm/third_party/* ${CR_SRC_DIR}/third_party/ &&
 	cp -r -v arm/raspi/* ${CR_SRC_DIR}/ &&
+	cp -v other/thor_ver_linux/wrapper-raspi ${CR_SRC_DIR}/chrome/installer/linux/common/wrapper &&
 	cp -v pak_src/binaries/pak_arm64 ${CR_SRC_DIR}/out/thorium/pak &&
 	#./infra/fix_libaom.sh &&
 	printf "\n" &&
@@ -211,7 +212,7 @@ copyAVX512 () {
 	printf "${YEL}Copying AVX-512 build files...${c0}\n" &&
 	cp -r -v other/AVX2/third_party/* ${CR_SRC_DIR}/third_party/ &&
 	cp -v other/AVX512/thor_ver ${CR_SRC_DIR}/out/thorium/ &&
-	cp -v infra/thor_ver_linux/wrapper-avx512 ${CR_SRC_DIR}/chrome/installer/linux/common/wrapper &&
+	cp -v other/thor_ver_linux/wrapper-avx512 ${CR_SRC_DIR}/chrome/installer/linux/common/wrapper &&
 	[ -f ${CR_SRC_DIR}/third_party/ffmpeg/ffmpeg_hevc_ac3.patch ] || patchAC3;
 	printf "\n"
 }
@@ -225,7 +226,7 @@ copyAVX2 () {
 	printf "${YEL}Copying AVX2 build files...${c0}\n" &&
 	cp -r -v other/AVX2/third_party/* ${CR_SRC_DIR}/third_party/ &&
 	cp -v other/AVX2/thor_ver ${CR_SRC_DIR}/out/thorium/ &&
-	cp -v infra/thor_ver_linux/wrapper-avx2 ${CR_SRC_DIR}/chrome/installer/linux/common/wrapper &&
+	cp -v other/thor_ver_linux/wrapper-avx2 ${CR_SRC_DIR}/chrome/installer/linux/common/wrapper &&
 	[ -f ${CR_SRC_DIR}/third_party/ffmpeg/ffmpeg_hevc_ac3.patch ] || patchAC3;
 	printf "\n"
 }
@@ -238,7 +239,7 @@ copySSE4 () {
 	printf "\n" &&
 	printf "${YEL}Copying SSE4.1 build files...${c0}\n" &&
 	cp -v other/SSE4.1/thor_ver ${CR_SRC_DIR}/out/thorium/ &&
-	cp -v infra/thor_ver_linux/wrapper-sse4 ${CR_SRC_DIR}/chrome/installer/linux/common/wrapper &&
+	cp -v other/thor_ver_linux/wrapper-sse4 ${CR_SRC_DIR}/chrome/installer/linux/common/wrapper &&
 	[ -f ${CR_SRC_DIR}/third_party/ffmpeg/ffmpeg_hevc_ac3.patch ] || patchAC3;
 	printf "\n"
 }
@@ -251,7 +252,7 @@ copySSE3 () {
 	printf "\n" &&
 	printf "${YEL}Copying SSE3 build files...${c0}\n" &&
 	cp -v other/SSE3/thor_ver ${CR_SRC_DIR}/out/thorium/ &&
-	cp -v infra/thor_ver_linux/wrapper-sse3 ${CR_SRC_DIR}/chrome/installer/linux/common/wrapper &&
+	cp -v other/thor_ver_linux/wrapper-sse3 ${CR_SRC_DIR}/chrome/installer/linux/common/wrapper &&
 	cd ${CR_SRC_DIR} &&
 	python3 tools/update_pgo_profiles.py --target=win32 update --gs-url-base=chromium-optimization-profiles/pgo_profiles &&
 	cd ~/thorium &&
@@ -267,7 +268,7 @@ copySSE2 () {
 	printf "\n" &&
 	printf "${YEL}Copying SSE2 (32-bit) build files...${c0}\n" &&
 	cp -v other/SSE2/thor_ver ${CR_SRC_DIR}/out/thorium/ &&
-	cp -v infra/thor_ver_linux/wrapper-sse2 ${CR_SRC_DIR}/chrome/installer/linux/common/wrapper &&
+	cp -v other/thor_ver_linux/wrapper-sse2 ${CR_SRC_DIR}/chrome/installer/linux/common/wrapper &&
 	cd ${CR_SRC_DIR} &&
 	python3 tools/update_pgo_profiles.py --target=win32 update --gs-url-base=chromium-optimization-profiles/pgo_profiles &&
 	cd ~/thorium &&

src/build/config/compiler/BUILD.gn

@@ -2331,6 +2331,9 @@ config("no_chromium_code") {
       # third-party libraries.
       "-Wno-c++11-narrowing",
     ]
+    if (is_full_optimization_build) {
+      cflags += [ "-Xclang", "-O3" ]
+    }
     if (!is_nacl) {
       cflags += [
         # Disabled for similar reasons as -Wunused-variable.

src/chrome/browser/ui/ui_features.cc

@@ -104,11 +104,6 @@ BASE_FEATURE(kAccessCodeCastUI,
              base::FEATURE_ENABLED_BY_DEFAULT);
 #endif
 
-// Enables showing the EV certificate details in the Page Info bubble.
-BASE_FEATURE(kEvDetailsInPageInfo,
-             "EvDetailsInPageInfo",
-             base::FEATURE_ENABLED_BY_DEFAULT);
-
 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) || BUILDFLAG(IS_LINUX)
 // Enables the feature to remove the last confirmation dialog when relaunching
 // to update Chrome.
@@ -118,11 +113,6 @@ BASE_FEATURE(kFewerUpdateConfirmations,
 #endif
 
 #if !BUILDFLAG(IS_ANDROID) && BUILDFLAG(GOOGLE_CHROME_BRANDING)
-// Enables showing the "Get the most out of Chrome" section in settings.
-BASE_FEATURE(kGetTheMostOutOfChrome,
-             "GetTheMostOutOfChrome",
-             base::FEATURE_DISABLED_BY_DEFAULT);
-
 // This feature controls whether the user can be shown the Chrome for iOS promo
 // when saving or updating passwords.
 BASE_FEATURE(kIOSPromoRefreshedPasswordBubble,
@@ -187,6 +177,7 @@ BASE_FEATURE(kLightweightExtensionOverrideConfirmations,
 BASE_FEATURE(kPreloadTopChromeWebUI,
              "PreloadTopChromeWebUI",
              base::FEATURE_DISABLED_BY_DEFAULT);
+
 const char kPreloadTopChromeWebUIModeName[] = "preload-mode";
 const char kPreloadTopChromeWebUIModePreloadOnWarmupName[] =
     "preload-on-warmup";
@@ -203,16 +194,26 @@ const base::FeatureParam<PreloadTopChromeWebUIMode> kPreloadTopChromeWebUIMode{
     &kPreloadTopChromeWebUI, kPreloadTopChromeWebUIModeName,
     PreloadTopChromeWebUIMode::kPreloadOnMakeContents,
     &kPreloadTopChromeWebUIModeOptions};
+
 const char kPreloadTopChromeWebUISmartPreloadName[] = "smart-preload";
 const base::FeatureParam<bool> kPreloadTopChromeWebUISmartPreload{
     &kPreloadTopChromeWebUI, kPreloadTopChromeWebUISmartPreloadName, false};
 
+const char kPreloadTopChromeWebUIDelayPreloadName[] = "delay-preload";
+const base::FeatureParam<bool> kPreloadTopChromeWebUIDelayPreload{
+    &kPreloadTopChromeWebUI, kPreloadTopChromeWebUIDelayPreloadName, false};
+
+const char kPreloadTopChromeWebUIExcludeOriginsName[] = "exclude-origins";
+const base::FeatureParam<std::string> kPreloadTopChromeWebUIExcludeOrigins{
+    &kPreloadTopChromeWebUI, kPreloadTopChromeWebUIExcludeOriginsName, ""};
+
 // Enables exiting browser fullscreen (users putting the browser itself into the
 // fullscreen mode via the browser UI or shortcuts) with press-and-hold Esc.
 #if !BUILDFLAG(IS_ANDROID)
 BASE_FEATURE(kPressAndHoldEscToExitBrowserFullscreen,
              "PressAndHoldEscToExitBrowserFullscreen",
-             base::FEATURE_DISABLED_BY_DEFAULT);
+             base::FEATURE_ENABLED_BY_DEFAULT
+);
 #endif
 
 // Enable responsive toolbar. Toolbar buttons overflow to a chevron button when
@@ -266,6 +267,10 @@ BASE_FEATURE(kSidePanelResizing,
              "SidePanelResizing",
              base::FEATURE_DISABLED_BY_DEFAULT);
 
+BASE_FEATURE(kTabDuplicateMetrics,
+             "TabDuplicateMetrics",
+             base::FEATURE_ENABLED_BY_DEFAULT);
+
 // Enables buttons when scrolling the tabstrip https://crbug.com/951078
 BASE_FEATURE(kTabScrollingButtonPosition,
              "TabScrollingButtonPosition",
@@ -301,12 +306,20 @@ const char kTabHoverCardAdditionalMaxWidthDelay[] =
 
 BASE_FEATURE(kTabOrganization,
              "TabOrganization",
-             base::FEATURE_DISABLED_BY_DEFAULT);
+             base::FEATURE_ENABLED_BY_DEFAULT);
 
 bool IsTabOrganization() {
   return base::FeatureList::IsEnabled(features::kTabOrganization);
 }
 
+BASE_FEATURE(kTabstripDeclutter,
+             "TabstripDeclutter",
+             base::FEATURE_DISABLED_BY_DEFAULT);
+
+bool IsTabstripDeclutterEnabled() {
+  return base::FeatureList::IsEnabled(features::kTabstripDeclutter);
+}
+
 BASE_FEATURE(kMultiTabOrganization,
              "MultiTabOrganization",
              base::FEATURE_DISABLED_BY_DEFAULT);
@@ -323,6 +336,14 @@ BASE_FEATURE(kTabReorganizationDivider,
              "TabReorganizationDivider",
              base::FEATURE_DISABLED_BY_DEFAULT);
 
+BASE_FEATURE(kTabOrganizationModelStrategy,
+             "TabOrganizationModelStrategy",
+             base::FEATURE_DISABLED_BY_DEFAULT);
+
+BASE_FEATURE(kTabOrganizationEnableNudgeForEnterprise,
+             "TabOrganizationEnableNudgeForEnterprise",
+             base::FEATURE_DISABLED_BY_DEFAULT);
+
 const base::FeatureParam<base::TimeDelta> kTabOrganizationTriggerPeriod{
     &kTabOrganization, "trigger_period", base::Hours(6)};
 
@@ -338,6 +359,7 @@ const base::FeatureParam<double> kTabOrganizationTriggerSensitivityThreshold{
 const base::FeatureParam<bool> KTabOrganizationTriggerDemoMode{
     &kTabOrganization, "trigger_demo_mode", false};
 
+// Alex313031: Investigate
 BASE_FEATURE(kTabSearchChevronIcon,
              "TabSearchChevronIcon",
              base::FEATURE_ENABLED_BY_DEFAULT);
@@ -347,8 +369,6 @@ BASE_FEATURE(kTabSearchFeedback,
              "TabSearchFeedback",
              base::FEATURE_DISABLED_BY_DEFAULT);
 
-
-
 // Controls feature parameters for Tab Search's `Recently Closed` entries.
 BASE_FEATURE(kTabSearchRecentlyClosed,
              "TabSearchRecentlyClosed",
@@ -401,19 +421,19 @@ BASE_FEATURE(kEnterpriseProfileBadging,
              "EnterpriseProfileBadging",
              base::FEATURE_ENABLED_BY_DEFAULT);
 
-// Enables the management button on the toolbar.
+// Enables the management button on the toolbar for all managed browsers.
 BASE_FEATURE(kManagementToolbarButton,
              "ManagementToolbarButton",
              base::FEATURE_DISABLED_BY_DEFAULT);
 
-BASE_FEATURE(kEnterpriseUpdatedProfileCreationScreen,
-             "EnterpriseUpdatedProfileCreationScreen",
+// Enables the management button on the toolbar by default for browser managed
+// by trusted sources.
+BASE_FEATURE(kManagementToolbarButtonForTrustedManagementSources,
+             "ManagementToolbarButtonForTrustedManagementSources",
              base::FEATURE_DISABLED_BY_DEFAULT);
 
-// This enables enables persistence of a WebContents in a 1-to-1 association
-// with the current Profile for WebUI bubbles. See https://crbug.com/1177048.
-BASE_FEATURE(kWebUIBubblePerProfilePersistence,
-             "WebUIBubblePerProfilePersistence",
+BASE_FEATURE(kEnterpriseUpdatedProfileCreationScreen,
+             "EnterpriseUpdatedProfileCreationScreen",
              base::FEATURE_DISABLED_BY_DEFAULT);
 
 // Enables a web-based tab strip. See https://crbug.com/989131. Note this
@@ -423,7 +443,8 @@ BASE_FEATURE(kWebUITabStrip,
 #if BUILDFLAG(IS_CHROMEOS)
              base::FEATURE_ENABLED_BY_DEFAULT
 #else
-             base::FEATURE_ENABLED_BY_DEFAULT
+// Test on and off
+             base::FEATURE_DISABLED_BY_DEFAULT
 #endif
 );
 
@@ -444,10 +465,6 @@ BASE_FEATURE(kViewsFirstRunDialog,
              "ViewsFirstRunDialog",
              base::FEATURE_DISABLED_BY_DEFAULT);
 
-BASE_FEATURE(kViewsTaskManager,
-             "ViewsTaskManager",
-             base::FEATURE_DISABLED_BY_DEFAULT);
-
 BASE_FEATURE(kViewsJSAppModalDialog,
              "ViewsJSAppModalDialog",
              base::FEATURE_DISABLED_BY_DEFAULT);
@@ -465,4 +482,10 @@ BASE_FEATURE(kUsePortalAccentColor,
              base::FEATURE_ENABLED_BY_DEFAULT);
 #endif
 
+BASE_FEATURE(kCompactMode, "CompactMode", base::FEATURE_DISABLED_BY_DEFAULT);
+
+BASE_FEATURE(kPageSpecificDataDialogRelatedInstalledAppsSection,
+             "PageSpecificDataDialogRelatedInstalledAppsSection",
+             base::FEATURE_DISABLED_BY_DEFAULT);
+
 }  // namespace features

src/chrome/browser/ui/views/toolbar/reload_button.cc

@@ -41,9 +41,11 @@ ReloadButton::ReloadButton(CommandUpdater* command_updater)
                     CreateMenuModel(),
                     nullptr),
       command_updater_(command_updater),
-      reload_icon_(base::CommandLine::ForCurrentProcess()->HasSwitch("disable-thorium-icons")
-                       ? vector_icons::kReloadChromeRefreshIcon
-                       : vector_icons::kReloadChromeRefreshThoriumIcon),
+      static const bool disable_thorium_icons = 
+          base::CommandLine::ForCurrentProcess()->HasSwitch("disable-thorium-icons");
+      reload_icon_(disable_thorium_icons
+                   ? vector_icons::kReloadChromeRefreshIcon
+                   : vector_icons::kReloadChromeRefreshThoriumIcon),
       reload_touch_icon_(kReloadTouchIcon),
       stop_icon_(kNavigateStopChromeRefreshIcon),
       stop_touch_icon_(kNavigateStopTouchIcon),

src/chrome/install_static/chromium_install_modes.cc

@@ -71,6 +71,10 @@ const InstallConstants kInstallModes[] = {
         .app_icon_resource_index =
             icon_resources::kApplicationIndex,  // App icon resource index.
         .app_icon_resource_id = IDR_MAINFRAME,  // App icon resource id.
+        .html_doc_icon_resource_index =
+            icon_resources::kHtmlDocIndex,  // HTML doc icon resource index.
+        .pdf_doc_icon_resource_index =
+            icon_resources::kPDFDocIndex,  // PDF doc icon resource index.
         .sandbox_sid_prefix =
             L"S-1-15-2-3251537155-1984446955-2931258699-841473695-1938553385-"
             L"924012148-",  // App container sid prefix for sandbox.

src/components/dom_distiller/core/dom_distiller_features.cc

@@ -13,16 +13,17 @@
 
 namespace dom_distiller {
 
-BASE_FEATURE(kReaderMode, "ReaderMode", base::FEATURE_ENABLED_BY_DEFAULT);
+static const bool kReaderModeDesktop =
+    base::CommandLine::ForCurrentProcess()->HasSwitch("reader-mode");
 
 bool IsDomDistillerEnabled() {
-  return true;
+  return base::CommandLine::ForCurrentProcess()->HasSwitch(
+      switches::kEnableDomDistiller) || kReaderModeDesktop;
 }
 
 bool ShouldStartDistillabilityService() {
   return base::CommandLine::ForCurrentProcess()->HasSwitch(
-      switches::kEnableDistillabilityService) ||
-      base::FeatureList::IsEnabled(kReaderMode);
+      switches::kEnableDistillabilityService) || kReaderModeDesktop;
 }
 
 }  // namespace dom_distiller

src/net/cert/x509_util.cc

@@ -2,11 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-#ifdef UNSAFE_BUFFERS_BUILD
-// TODO(crbug.com/40284755): Remove this and spanify to fix the errors.
-#pragma allow_unsafe_buffers
-#endif
-
 #include "net/cert/x509_util.h"
 
 #include <string.h>
@@ -188,7 +183,7 @@ bssl::ParsedCertificateList ParseAllValidCerts(
     std::shared_ptr<const bssl::ParsedCertificate> cert =
         bssl::ParsedCertificate::Create(
             bssl::UpRef(x509_cert->cert_buffer()),
-            net::x509_util::DefaultParseCertificateOptions(), NULL);
+            net::x509_util::DefaultParseCertificateOptions(), nullptr);
     if (cert) {
       parsed_certs.push_back(std::move(cert));
     }
@@ -272,15 +267,16 @@ bool GetTLSServerEndPointChannelBinding(const X509Certificate& certificate,
   if (!digest_evp_md)
     return false;
 
-  uint8_t digest[EVP_MAX_MD_SIZE];
+  std::array<uint8_t, EVP_MAX_MD_SIZE> digest;
   unsigned int out_size;
   if (!EVP_Digest(der_encoded_certificate.data(),
-                  der_encoded_certificate.size(), digest, &out_size,
-                  digest_evp_md, nullptr))
+                  der_encoded_certificate.size(), digest.data(), &out_size,
+                  digest_evp_md, nullptr)) {
     return false;
+  }
 
   token->assign(kChannelBindingPrefix);
-  token->append(digest, digest + out_size);
+  token->append(base::as_string_view(digest).substr(0, out_size));
   return true;
 }
 
@@ -440,9 +436,7 @@ bssl::UniquePtr<CRYPTO_BUFFER> CreateCryptoBuffer(
 }
 
 bssl::UniquePtr<CRYPTO_BUFFER> CreateCryptoBuffer(std::string_view data) {
-  return bssl::UniquePtr<CRYPTO_BUFFER>(
-      CRYPTO_BUFFER_new(reinterpret_cast<const uint8_t*>(data.data()),
-                        data.size(), GetBufferPool()));
+  return CreateCryptoBuffer(base::as_byte_span(data));
 }
 
 bssl::UniquePtr<CRYPTO_BUFFER> CreateCryptoBufferFromStaticDataUnsafe(
@@ -456,19 +450,18 @@ bool CryptoBufferEqual(const CRYPTO_BUFFER* a, const CRYPTO_BUFFER* b) {
   DCHECK(a && b);
   if (a == b)
     return true;
-  return CRYPTO_BUFFER_len(a) == CRYPTO_BUFFER_len(b) &&
-         memcmp(CRYPTO_BUFFER_data(a), CRYPTO_BUFFER_data(b),
-                CRYPTO_BUFFER_len(a)) == 0;
+  return CryptoBufferAsSpan(a) == CryptoBufferAsSpan(b);
 }
 
 std::string_view CryptoBufferAsStringPiece(const CRYPTO_BUFFER* buffer) {
-  return std::string_view(
-      reinterpret_cast<const char*>(CRYPTO_BUFFER_data(buffer)),
-      CRYPTO_BUFFER_len(buffer));
+  return base::as_string_view(CryptoBufferAsSpan(buffer));
 }
 
 base::span<const uint8_t> CryptoBufferAsSpan(const CRYPTO_BUFFER* buffer) {
-  return base::make_span(CRYPTO_BUFFER_data(buffer), CRYPTO_BUFFER_len(buffer));
+  // SAFETY: CRYPTO_BUFFER_data(buffer) returns a pointer to data that is
+  // CRYPTO_BUFFER_len(buffer) bytes in length.
+  return UNSAFE_BUFFERS(
+      base::make_span(CRYPTO_BUFFER_data(buffer), CRYPTO_BUFFER_len(buffer)));
 }
 
 scoped_refptr<X509Certificate> CreateX509CertificateFromBuffers(
@@ -570,8 +563,7 @@ bool HasRsaPkcs1Sha1Signature(const CRYPTO_BUFFER* cert_buffer) {
   bssl::der::Input tbs_certificate_tlv;
   bssl::der::Input signature_algorithm_tlv;
   bssl::der::BitString signature_value;
-  if (!bssl::ParseCertificate(bssl::der::Input(CRYPTO_BUFFER_data(cert_buffer),
-                                               CRYPTO_BUFFER_len(cert_buffer)),
+  if (!bssl::ParseCertificate(bssl::der::Input(CryptoBufferAsSpan(cert_buffer)),
                               &tbs_certificate_tlv, &signature_algorithm_tlv,
                               &signature_value, /*out_errors=*/nullptr)) {
     return false;

src/sandbox/linux/BUILD.gn

@@ -303,7 +303,7 @@ if (is_linux || is_chromeos) {
 
       # These files have a suspicious comparison.
       # TODO fix this and re-enable this warning.
-      "-Wno-sign-compare",
+      # "-Wno-sign-compare",
       "-O3",
       "-fPIE",
     ]