20 changed files with 8413 additions and 6933 deletions
--- a/chromium-127-rust-clanglib.patch
+++ b/chromium-127-rust-clanglib.patch
@@ -11,8 +11,8 @@ Index: chromium-144.0.7524.0/build/rust/rust_bindgen.gni
 }
 
 # Template to build Rust/C bindings with bindgen.
-@@ -129,6 +129,13 @@ template("rust_bindgen") {
-       deps += [ ":${_rust_bindgen_generator_name}_static_fns" ]
+@@ -135,6 +135,13 @@
+       deps += [ ":${_rust_bindgen_generator_target_name}_static_fns" ]
     }
 
 +    # Default configs include "-fvisibility=hidden", and for some reason this
@@ -22,9 +22,9 @@ Index: chromium-144.0.7524.0/build/rust/rust_bindgen.gni
 +      args += [ "-fvisibility=default" ]
 +    }
 +
-     if (defined(cpp) && cpp) {
-       # This cfg is used to control the bindings public export.
-       rustflags = [
+     rustflags = [
+       # Don't warn about unused code in the generated bindings.
+       "-Adead_code",
 Index: chromium-144.0.7524.0/build/rust/rust_bindgen_generator.gni
 ===================================================================
 --- chromium-144.0.7524.0.orig/build/rust/rust_bindgen_generator.gni
--- a/chromium-141-no_cxx_modules.patch
+++ b/chromium-141-no_cxx_modules.patch
@@ -1,14 +1,13 @@
--- chromium-141.0.7390.37/third_party/pthreadpool/chromium/jobs.cc	2025/10/02 13:48:22	1.1
-+++ chromium-141.0.7390.37/third_party/pthreadpool/chromium/jobs.cc	2025/10/02 13:50:01
-@@ -22,9 +22,10 @@
+Index: chromium-145.0.7561.2/third_party/pthreadpool/chromium/jobs.cc
+===================================================================
+--- chromium-145.0.7561.2.orig/third_party/pthreadpool/chromium/jobs.cc
+++ chromium-145.0.7561.2/third_party/pthreadpool/chromium/jobs.cc
+@@ -23,7 +23,7 @@
 // Note that we can't use #if !defined(__cpp_module) due to it not actually
 // being defined - see https://github.com/llvm/llvm-project/issues/71364 and
 // https://github.com/llvm/llvm-project/blob/b251c29af45d3440374f53bb4c1645e5968593f7/clang/lib/Frontend/InitPreprocessor.cpp#L747
-#ifndef USE_LIBCXX_MODULES
+-#if !defined(USE_LIBCXX_MODULES) || defined(_MSC_VER)
 +#if 1
 #include <atomic>
 #define _LIBCPP_STDATOMIC_H
-+#define __CLANG_STDATOMIC_H
 using namespace std;
- #endif
- 
--- a/chromium-144-revert-libxml-2.13.patch
+++ b/chromium-144-revert-libxml-2.13.patch
@@ -12,7 +12,7 @@
 
   // libxml should not be configured with catalogs enabled, so it
@@ -756,18 +760,7 @@
-   InitializeLibXMLIfNecessary();
+   EnsureLibXMLInitialized();
   xmlParserCtxtPtr parser =
       xmlCreatePushParserCtxt(handlers, nullptr, nullptr, 0, nullptr);
 -
--- a/chromium-144.0.7559.132-linux.tar.xz
+++ b/chromium-144.0.7559.132-linux.tar.xz
--- a/chromium-145-blink_missing_include.patch
+++ b/chromium-145-blink_missing_include.patch
@@ -0,0 +1,22 @@
+--- chromium-145.0.7572.2/third_party/blink/renderer/modules/xr/xr_cpu_depth_information.h	2025/12/16 14:51:38	1.1
+++ chromium-145.0.7572.2/third_party/blink/renderer/modules/xr/xr_cpu_depth_information.h	2025/12/16 14:51:49
+@@ -9,6 +9,8 @@
+ #include "device/vr/public/mojom/xr_session.mojom-blink-forward.h"
+ #include "third_party/blink/renderer/core/typed_arrays/dom_array_buffer.h"
+ #include "third_party/blink/renderer/modules/xr/xr_depth_information.h"
+#include "ui/gfx/geometry/size.h"
+#include "ui/gfx/geometry/transform.h"
+ 
+ namespace gfx {
+ class Size;
+--- chromium-145.0.7572.2/third_party/blink/renderer/modules/xr/xr_rigid_transform.h	2025/12/17 11:11:31	1.1
+++ chromium-145.0.7572.2/third_party/blink/renderer/modules/xr/xr_rigid_transform.h	2025/12/17 11:12:00
+@@ -11,6 +11,8 @@
+ #include "third_party/blink/renderer/core/typed_arrays/dom_typed_array.h"
+ #include "third_party/blink/renderer/modules/modules_export.h"
+ #include "third_party/blink/renderer/platform/bindings/script_wrappable.h"
+#include "ui/gfx/geometry/size.h"
+#include "ui/gfx/geometry/transform.h"
+ 
+ namespace gfx {
+ class Transform;
--- a/chromium-145-use_unrar.patch
+++ b/chromium-145-use_unrar.patch
@@ -0,0 +1,158 @@
+--- chromium-145.0.7587.4/chrome/services/file_util/BUILD.gn	2025/12/26 12:24:52	1.1
+++ chromium-145.0.7587.4/chrome/services/file_util/BUILD.gn	2025/12/26 12:27:01
+@@ -25,10 +25,13 @@
+     "//components/safe_browsing:buildflags",
+     "//extensions/buildflags",
+     "//mojo/public/cpp/bindings",
+-    "//third_party/unrar",
+     "//third_party/zlib",
+   ]
+ 
+  if (safe_browsing_use_unrar) {
+    deps += [ "//third_party/unrar" ]
+  }
+
+   public_deps = [
+     "//chrome/services/file_util/public/mojom",
+     "//components/safe_browsing/core/common",
+--- chromium-145.0.7587.4/chrome/services/file_util/obfuscated_archive_analysis_delegate.cc	2025/12/26 12:31:33	1.1
+++ chromium-145.0.7587.4/chrome/services/file_util/obfuscated_archive_analysis_delegate.cc	2025/12/26 12:33:45
+@@ -115,6 +115,7 @@
+   bool closed_ = false;
+ };
+ 
+#if USE_UNRAR
+ class ObfuscatedRarReaderDelegate
+     : public third_party_unrar::RarReaderDelegate {
+  public:
+@@ -186,6 +187,7 @@
+   std::unique_ptr<enterprise_obfuscation::DownloadObfuscator> obfuscator_;
+   bool init_ = false;
+ };
+#endif
+ 
+ }  // namespace
+ 
+@@ -214,6 +216,7 @@
+   return std::make_unique<ObfuscatedZipWriterDelegate>(std::move(file));
+ }
+ 
+#if USE_UNRAR
+ std::unique_ptr<third_party_unrar::RarReaderDelegate>
+ ObfuscatedArchiveAnalysisDelegate::CreateRarReaderDelegate(base::File file) {
+   base::expected<enterprise_obfuscation::ObfuscatedFileReader,
+@@ -231,6 +234,7 @@
+ ObfuscatedArchiveAnalysisDelegate::CreateRarWriterDelegate(base::File file) {
+   return std::make_unique<ObfuscatedRarWriterDelegate>(std::move(file));
+ }
+#endif
+ 
+ std::unique_ptr<ArchiveAnalysisDelegate>
+ ObfuscatedArchiveAnalysisDelegate::CreateNestedDelegate(
+--- chromium-145.0.7587.4/chrome/services/file_util/obfuscated_archive_analysis_delegate.h	2025/12/26 12:33:53	1.1
+++ chromium-145.0.7587.4/chrome/services/file_util/obfuscated_archive_analysis_delegate.h	2025/12/26 12:34:20
+@@ -7,7 +7,9 @@
+ 
+ #include "chrome/utility/safe_browsing/archive_analysis_delegate.h"
+ #include "components/enterprise/obfuscation/core/utils.h"
+#if USE_UNRAR
+ #include "third_party/unrar/google/unrar_wrapper.h"
+#endif
+ 
+ namespace safe_browsing {
+ 
+@@ -22,10 +24,12 @@
+       base::File file) override;
+   std::unique_ptr<SafeBrowsingZipWriterDelegate> CreateZipWriterDelegate(
+       base::File file) override;
+#if USE_UNRAR
+   std::unique_ptr<third_party_unrar::RarReaderDelegate> CreateRarReaderDelegate(
+       base::File file) override;
+   std::unique_ptr<third_party_unrar::RarWriterDelegate> CreateRarWriterDelegate(
+       base::File file) override;
+#endif
+   std::unique_ptr<ArchiveAnalysisDelegate> CreateNestedDelegate(
+       base::File extracted_file) override;
+ 
+--- chromium-145.0.7587.4/chrome/services/file_util/regular_archive_analysis_delegate.cc	2025/12/26 12:35:30	1.1
+++ chromium-145.0.7587.4/chrome/services/file_util/regular_archive_analysis_delegate.cc	2025/12/26 12:36:02
+@@ -8,8 +8,10 @@
+ 
+ #include "base/files/file.h"
+ #include "chrome/utility/safe_browsing/zip_writer_delegate.h"
+#if USE_UNRAR
+ #include "third_party/unrar/google/unrar_delegates.h"
+ #include "third_party/unrar/google/unrar_wrapper.h"
+#endif
+ #include "third_party/zlib/google/zip_reader.h"
+ 
+ namespace safe_browsing {
+@@ -91,6 +93,7 @@
+   return std::make_unique<ZipWriterDelegate>(std::move(file));
+ }
+ 
+#if USE_UNRAR
+ std::unique_ptr<third_party_unrar::RarReaderDelegate>
+ RegularArchiveAnalysisDelegate::CreateRarReaderDelegate(base::File file) {
+   return std::make_unique<third_party_unrar::FileReader>(std::move(file));
+@@ -100,6 +103,7 @@
+ RegularArchiveAnalysisDelegate::CreateRarWriterDelegate(base::File file) {
+   return std::make_unique<third_party_unrar::FileWriter>(std::move(file));
+ }
+#endif
+ 
+ std::unique_ptr<ArchiveAnalysisDelegate>
+ RegularArchiveAnalysisDelegate::CreateNestedDelegate(
+--- chromium-145.0.7587.4/chrome/services/file_util/regular_archive_analysis_delegate.h	2025/12/26 12:36:04	1.1
+++ chromium-145.0.7587.4/chrome/services/file_util/regular_archive_analysis_delegate.h	2025/12/26 12:36:44
+@@ -6,7 +6,9 @@
+ #define CHROME_SERVICES_FILE_UTIL_REGULAR_ARCHIVE_ANALYSIS_DELEGATE_H_
+ 
+ #include "chrome/utility/safe_browsing/archive_analysis_delegate.h"
+#if USE_UNRAR
+ #include "third_party/unrar/google/unrar_delegates.h"
+#endif
+ 
+ namespace safe_browsing {
+ 
+@@ -20,10 +22,12 @@
+       base::File file) override;
+   std::unique_ptr<SafeBrowsingZipWriterDelegate> CreateZipWriterDelegate(
+       base::File file) override;
+#if USE_UNRAR
+   std::unique_ptr<third_party_unrar::RarReaderDelegate> CreateRarReaderDelegate(
+       base::File file) override;
+   std::unique_ptr<third_party_unrar::RarWriterDelegate> CreateRarWriterDelegate(
+       base::File file) override;
+#endif
+   std::unique_ptr<ArchiveAnalysisDelegate> CreateNestedDelegate(
+       base::File extracted_file) override;
+ };
+--- chromium-145.0.7587.4/chrome/utility/safe_browsing/archive_analysis_delegate.h	2025/12/26 12:37:02	1.1
+++ chromium-145.0.7587.4/chrome/utility/safe_browsing/archive_analysis_delegate.h	2025/12/26 12:37:35
+@@ -9,7 +9,9 @@
+ 
+ #include "base/files/file.h"
+ #include "chrome/utility/safe_browsing/zip_writer_delegate.h"
+#if USE_UNRAR
+ #include "third_party/unrar/google/unrar_delegates.h"
+#endif
+ #include "third_party/zlib/google/zip_reader.h"
+ 
+ namespace safe_browsing {
+@@ -28,6 +30,7 @@
+   virtual std::unique_ptr<SafeBrowsingZipWriterDelegate>
+   CreateZipWriterDelegate(base::File file) = 0;
+ 
+#if USE_UNRAR
+   // Creates a reader delegate for reading the RAR archive.
+   virtual std::unique_ptr<third_party_unrar::RarReaderDelegate>
+   CreateRarReaderDelegate(base::File file) = 0;
+@@ -35,6 +38,7 @@
+   // Creates a writer delegate for writing extracted RAR entries.
+   virtual std::unique_ptr<third_party_unrar::RarWriterDelegate>
+   CreateRarWriterDelegate(base::File file) = 0;
+#endif
+ 
+   // Creates a delegate for analyzing a nested archive extracted from the
+   // current archive. Returns nullptr if the nested archive cannot be handled
--- a/chromium-145.0.7632.75-linux.tar.xz
+++ b/chromium-145.0.7632.75-linux.tar.xz
--- a/chromium-24264eefbfd3464161764f31a2752c5327719452.patch
+++ b/chromium-24264eefbfd3464161764f31a2752c5327719452.patch
@@ -0,0 +1,62 @@
+commit 24264eefbfd3464161764f31a2752c5327719452
+Author: Nic Champagne Williamson <champnic@microsoft.com>
+Date:   Thu Jan 8 17:12:28 2026 -0800
+
+    Fix vaapi jpeg fuzzer
+    
+    As part of semi-automated spanification effort, the
+    jpeg_decoder_fuzzertest.cc was spanified. However, this fuzzer is marked
+    as "no_clusterfuzz" and must be built and run manually, so the fuzz
+    build pipelines skipped it and it was never verified.
+    https://chromium-review.googlesource.com/c/chromium/src/+/7229449
+    
+    This change fixes the minor compilation issues with the fuzzer, mostly
+    by using "as_byte_span" for the arrays created by the protobuf code,
+    which default to std::string.
+    
+    Bug: 474097238
+    Change-Id: I575a9d90c546b2702517347245f857ce7f0ac4bc
+    Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7411409
+    Reviewed-by: Dale Curtis <dalecurtis@chromium.org>
+    Reviewed-by: Michael Tang <tangm@microsoft.com>
+    Commit-Queue: Nic Williamson <champnic@microsoft.com>
+    Cr-Commit-Position: refs/heads/main@{#1566648}
+
+diff --git a/media/gpu/vaapi/fuzzers/jpeg_decoder/jpeg_decoder_fuzzertest.cc b/media/gpu/vaapi/fuzzers/jpeg_decoder/jpeg_decoder_fuzzertest.cc
+index cd8c7593f911b..28e5914c7035c 100644
+--- a/media/gpu/vaapi/fuzzers/jpeg_decoder/jpeg_decoder_fuzzertest.cc
+++ b/media/gpu/vaapi/fuzzers/jpeg_decoder/jpeg_decoder_fuzzertest.cc
+@@ -54,12 +54,12 @@ media::JpegHuffmanTable ConvertToJpegHuffmanTable(
+       std::min(huffman_table.code_length.size(),
+                proto_huffman_table.code_length().size());
+   base::span(huffman_table.code_length)
+-      .copy_prefix_from(base::span(proto_huffman_table.code_value())
+      .copy_prefix_from(base::as_byte_span(proto_huffman_table.code_length())
+                             .first(code_length_min_size));
+   const size_t code_value_min_size = std::min(
+       huffman_table.code_value.size(), proto_huffman_table.code_value().size());
+   base::span(huffman_table.code_value)
+-      .copy_prefix_from(base::span(proto_huffman_table.code_value())
+      .copy_prefix_from(base::as_byte_span(proto_huffman_table.code_value())
+                             .first(code_value_min_size));
+   return huffman_table;
+ }
+@@ -131,7 +131,7 @@ media::JpegParseResult ConvertToJpegParseResult(
+     base::span(parse_result.q_table[i].value)
+         .first(value_min_size)
+         .copy_from_nonoverlapping(
+-            base::span(input_q_table.value()).first(value_min_size));
+            base::as_byte_span(input_q_table.value()).first(value_min_size));
+   }
+ 
+   // Convert the scan header.
+@@ -153,8 +153,7 @@ media::JpegParseResult ConvertToJpegParseResult(
+   // Convert the coded data. Note that we don't do a deep copy, so we assume
+   // that |proto_parse_result| will live for as long as |parse_result|.data is
+   // needed.
+-  parse_result.data = proto_parse_result.data().data();
+-  parse_result.data_size = proto_parse_result.data().size();
+  parse_result.data = base::as_byte_span(proto_parse_result.data());
+ 
+   // Convert the rest of the fields.
+   parse_result.restart_interval =
--- a/chromium-4f46f03a6c6d4c6efc1ad5d0d78030d02326f967.patch
+++ b/chromium-4f46f03a6c6d4c6efc1ad5d0d78030d02326f967.patch
@@ -0,0 +1,615 @@
+commit 4f46f03a6c6d4c6efc1ad5d0d78030d02326f967
+Author: Sergio Solano <sergiosolano@google.com>
+Date:   Mon Jan 5 01:50:52 2026 -0800
+
+    Spanification of jpeg_parser and related files
+    
+    This is the result of running the automatic spanification on linux and
+    updating code to use and pass spans where size is known.
+    
+    The original patch was fully automated using script:
+    //tools/clang/spanify/rewrite-multiple-platforms.sh -platforms=linux
+    Then refined with gemini-cli
+    
+    gemini-run/batch-run-1761710114/group_45
+    
+    BUG=439964610
+    
+    Convert JpegHuffmanTable::code_value from c-style array to `std::array`.
+    
+    This change updates the `JpegHuffmanTable::code_value` member from a C-style array to a `std::array<uint8_t, 162>`. Consequently, usages in `jpeg_decoder_fuzzertest.cc`, `vaapi_jpeg_encoder.cc`, and `jpeg_parser.cc` are updated to use `std::array` methods like `.size()` and `.data()`. In `vaapi_jpeg_encoder.cc`, `SafeArrayMemcpy` calls are replaced with `memcpy` and static assertions to handle the type change.
+    
+    spanification: automatically spanify media/parsers/jpeg_parser.cc etc.
+    
+    This is the result of running the automatic spanification on linux and
+    updating code to use and pass spans where size is known.
+    
+    The original patch was fully automated using script:
+    //tools/clang/spanify/rewrite-multiple-platforms.sh -platforms=linux
+    Then refined with gemini-cli
+    
+    gemini-run/batch-run-1761710114/group_45
+    
+    BUG=439964610
+    
+    Change-Id: Iea6219e18571ec93001cedd0ccd6d3925bbfd21b
+    Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7229449
+    Auto-Submit: Sergio Solano <sergiosolano@google.com>
+    Reviewed-by: Colin Blundell <blundell@chromium.org>
+    Commit-Queue: Colin Blundell <blundell@chromium.org>
+    Reviewed-by: Stephen Nusko <nuskos@chromium.org>
+    Cr-Commit-Position: refs/heads/main@{#1564243}
+
+diff --git a/media/gpu/vaapi/fuzzers/jpeg_decoder/jpeg_decoder_fuzzertest.cc b/media/gpu/vaapi/fuzzers/jpeg_decoder/jpeg_decoder_fuzzertest.cc
+index 3791e59f21c0d..cd8c7593f911b 100644
+--- a/media/gpu/vaapi/fuzzers/jpeg_decoder/jpeg_decoder_fuzzertest.cc
+++ b/media/gpu/vaapi/fuzzers/jpeg_decoder/jpeg_decoder_fuzzertest.cc
+@@ -50,12 +50,17 @@ media::JpegHuffmanTable ConvertToJpegHuffmanTable(
+     const media::fuzzing::JpegHuffmanTable& proto_huffman_table) {
+   media::JpegHuffmanTable huffman_table{};
+   huffman_table.valid = proto_huffman_table.valid();
+-  memcpy(huffman_table.code_length, proto_huffman_table.code_length().data(),
+-         std::min(std::size(huffman_table.code_length),
+-                  proto_huffman_table.code_length().size()));
+-  memcpy(huffman_table.code_value, proto_huffman_table.code_value().data(),
+-         std::min(std::size(huffman_table.code_value),
+-                  proto_huffman_table.code_value().size()));
+  const size_t code_length_min_size =
+      std::min(huffman_table.code_length.size(),
+               proto_huffman_table.code_length().size());
+  base::span(huffman_table.code_length)
+      .copy_prefix_from(base::span(proto_huffman_table.code_value())
+                            .first(code_length_min_size));
+  const size_t code_value_min_size = std::min(
+      huffman_table.code_value.size(), proto_huffman_table.code_value().size());
+  base::span(huffman_table.code_value)
+      .copy_prefix_from(base::span(proto_huffman_table.code_value())
+                            .first(code_value_min_size));
+   return huffman_table;
+ }
+ 
+@@ -121,9 +126,12 @@ media::JpegParseResult ConvertToJpegParseResult(
+     const media::fuzzing::JpegQuantizationTable& input_q_table =
+         proto_parse_result.q_table()[i];
+     parse_result.q_table[i].valid = input_q_table.valid();
+-    memcpy(parse_result.q_table[i].value, input_q_table.value().data(),
+-           std::min(std::size(parse_result.q_table[i].value),
+-                    input_q_table.value().size()));
+    const size_t value_min_size = std::min(
+        std::size(parse_result.q_table[i].value), input_q_table.value().size());
+    base::span(parse_result.q_table[i].value)
+        .first(value_min_size)
+        .copy_from_nonoverlapping(
+            base::span(input_q_table.value()).first(value_min_size));
+   }
+ 
+   // Convert the scan header.
+diff --git a/media/gpu/vaapi/vaapi_jpeg_decoder.cc b/media/gpu/vaapi/vaapi_jpeg_decoder.cc
+index 6501edd34d225..bb3d426ff4509 100644
+--- a/media/gpu/vaapi/vaapi_jpeg_decoder.cc
+++ b/media/gpu/vaapi/vaapi_jpeg_decoder.cc
+@@ -8,6 +8,7 @@
+ #include <va/va.h>
+ 
+ #include <iostream>
+#include <numeric>
+ #include <type_traits>
+ 
+ #include "base/compiler_specific.h"
+@@ -33,15 +34,17 @@ static void FillPictureParameters(
+   pic_param->picture_height = frame_header.coded_height;
+   pic_param->num_components = frame_header.num_components;
+ 
+-  for (int i = 0; i < pic_param->num_components; i++) {
+-    UNSAFE_TODO(pic_param->components[i]).component_id =
+-        frame_header.components[i].id;
+-    UNSAFE_TODO(pic_param->components[i]).h_sampling_factor =
+-        frame_header.components[i].horizontal_sampling_factor;
+-    UNSAFE_TODO(pic_param->components[i]).v_sampling_factor =
+-        frame_header.components[i].vertical_sampling_factor;
+-    UNSAFE_TODO(pic_param->components[i]).quantiser_table_selector =
+-        frame_header.components[i].quantization_table_selector;
+  const auto pic_param_components = base::span(pic_param->components);
+  const auto frame_header_components = base::span(frame_header.components);
+
+  for (size_t i = 0; i < frame_header_components.size(); i++) {
+    pic_param_components[i].component_id = frame_header_components[i].id;
+    pic_param_components[i].h_sampling_factor =
+        frame_header_components[i].horizontal_sampling_factor;
+    pic_param_components[i].v_sampling_factor =
+        frame_header_components[i].vertical_sampling_factor;
+    pic_param_components[i].quantiser_table_selector =
+        frame_header_components[i].quantization_table_selector;
+   }
+ }
+ 
+@@ -53,13 +56,17 @@ static void FillIQMatrix(base::span<const JpegQuantizationTable> q_table,
+   static_assert(
+       sizeof(iq_matrix->quantiser_table[0]) == sizeof(q_table[0].value),
+       "number of quantization entries mismatched");
+
+  auto load_quantiser_table = base::span(iq_matrix->load_quantiser_table);
+  auto iq_matrix_quantiser_table = base::span(iq_matrix->quantiser_table);
+
+   for (size_t i = 0; i < kJpegMaxQuantizationTableNum; i++) {
+     if (!q_table[i].valid)
+       continue;
+-    UNSAFE_TODO(iq_matrix->load_quantiser_table[i]) = 1;
+-    for (size_t j = 0; j < std::size(q_table[i].value); j++)
+-      UNSAFE_TODO(iq_matrix->quantiser_table[i][j]) =
+-          UNSAFE_TODO(q_table[i].value[j]);
+    load_quantiser_table[i] = 1;
+
+    auto dest_span = base::span(iq_matrix_quantiser_table[i]);
+    dest_span.copy_from_nonoverlapping(q_table[i].value);
+   }
+ }
+ 
+@@ -88,42 +95,49 @@ static void FillHuffmanTable(base::span<const JpegHuffmanTable> dc_table,
+   static_assert(sizeof(huffman_table->huffman_table[0].dc_values[0]) ==
+                     sizeof(dc_table[0].code_value[0]),
+                 "size of huffman table code value mismatch");
+
+  auto load_huffman_table_span = base::span(huffman_table->load_huffman_table);
+   for (size_t i = 0; i < kJpegMaxHuffmanTableNumBaseline; i++) {
+     if (!dc_table[i].valid || !ac_table[i].valid)
+       continue;
+-    UNSAFE_TODO(huffman_table->load_huffman_table[i]) = 1;
+-
+-    UNSAFE_TODO(memcpy(huffman_table->huffman_table[i].num_dc_codes,
+-                       dc_table[i].code_length,
+-                       sizeof(huffman_table->huffman_table[i].num_dc_codes)));
+-    UNSAFE_TODO(memcpy(huffman_table->huffman_table[i].dc_values,
+-                       dc_table[i].code_value,
+-                       sizeof(huffman_table->huffman_table[i].dc_values)));
+-    UNSAFE_TODO(memcpy(huffman_table->huffman_table[i].num_ac_codes,
+-                       ac_table[i].code_length,
+-                       sizeof(huffman_table->huffman_table[i].num_ac_codes)));
+-    UNSAFE_TODO(memcpy(huffman_table->huffman_table[i].ac_values,
+-                       ac_table[i].code_value,
+-                       sizeof(huffman_table->huffman_table[i].ac_values)));
+    load_huffman_table_span[i] = 1;
+    auto huffman_tbl = base::span(huffman_table->huffman_table);
+
+    base::span(huffman_tbl[i].num_dc_codes)
+        .copy_from_nonoverlapping(base::span(dc_table[i].code_length));
+    auto dc_values = base::span(huffman_tbl[i].dc_values);
+    dc_values.copy_from_nonoverlapping(
+        base::span(dc_table[i].code_value).first(dc_values.size()));
+    base::span(huffman_tbl[i].num_ac_codes)
+        .copy_from_nonoverlapping(base::span(ac_table[i].code_length));
+    auto ac_values = base::span(huffman_tbl[i].ac_values);
+    ac_values.copy_from_nonoverlapping(
+        base::span(ac_table[i].code_value).first(ac_values.size()));
+   }
+ }
+ 
+ static void FillSliceParameters(
+     const JpegParseResult& parse_result,
+     VASliceParameterBufferJPEGBaseline* slice_param) {
+-  slice_param->slice_data_size = parse_result.data_size;
+  slice_param->slice_data_size = parse_result.data.size();
+   slice_param->slice_data_offset = 0;
+   slice_param->slice_data_flag = VA_SLICE_DATA_FLAG_ALL;
+   slice_param->slice_horizontal_position = 0;
+   slice_param->slice_vertical_position = 0;
+   slice_param->num_components = parse_result.scan.num_components;
+-  for (int i = 0; i < slice_param->num_components; i++) {
+-    UNSAFE_TODO(slice_param->components[i]).component_selector =
+-        parse_result.scan.components[i].component_selector;
+-    UNSAFE_TODO(slice_param->components[i]).dc_table_selector =
+-        parse_result.scan.components[i].dc_selector;
+-    UNSAFE_TODO(slice_param->components[i]).ac_table_selector =
+-        parse_result.scan.components[i].ac_selector;
+
+  const auto slice_param_components =
+      base::span(slice_param->components).first(slice_param->num_components);
+  const auto scan_components = base::span(parse_result.scan.components)
+                                   .first(slice_param->num_components);
+
+  for (size_t i = 0; i < slice_param->num_components; i++) {
+    slice_param_components[i].component_selector =
+        scan_components[i].component_selector;
+    slice_param_components[i].dc_table_selector =
+        scan_components[i].dc_selector;
+    slice_param_components[i].ac_table_selector =
+        scan_components[i].ac_selector;
+   }
+   slice_param->restart_interval = parse_result.restart_interval;
+ 
+@@ -369,8 +383,8 @@ bool VaapiJpegDecoder::SubmitBuffers(const JpegParseResult& parse_result) {
+        {VAIQMatrixBufferType, sizeof(iq_matrix), &iq_matrix},
+        {VAHuffmanTableBufferType, sizeof(huffman_table), &huffman_table},
+        {VASliceParameterBufferType, sizeof(slice_param), &slice_param},
+-       {VASliceDataBufferType, parse_result.data_size,
+-        const_cast<char*>(parse_result.data)}});
+       {VASliceDataBufferType, parse_result.data.size(),
+        parse_result.data.data()}});
+ }
+ 
+ }  // namespace media
+diff --git a/media/gpu/vaapi/vaapi_jpeg_encoder.cc b/media/gpu/vaapi/vaapi_jpeg_encoder.cc
+index 97e4f9f077489..e87494c736341 100644
+--- a/media/gpu/vaapi/vaapi_jpeg_encoder.cc
+++ b/media/gpu/vaapi/vaapi_jpeg_encoder.cc
+@@ -9,6 +9,7 @@
+ 
+ #include <algorithm>
+ #include <array>
+#include <ranges>
+ #include <type_traits>
+ 
+ #include "base/check_op.h"
+@@ -80,42 +81,44 @@ void FillQMatrix(VAQMatrixBufferJPEG* q_matrix) {
+ 
+ void FillHuffmanTableParameters(
+     VAHuffmanTableBufferJPEGBaseline* huff_table_param) {
+-  static_assert(std::size(kDefaultDcTable) == std::size(kDefaultAcTable),
+  static_assert(kDefaultDcTable.size() == kDefaultAcTable.size(),
+                 "DC table and AC table size mismatch.");
+-  static_assert(std::size(kDefaultDcTable) ==
+-                    std::extent<decltype(huff_table_param->huffman_table)>(),
+  auto huffman_tables = base::span(huff_table_param->huffman_table);
+  static_assert(kDefaultDcTable.size() == huffman_tables.size(),
+                 "DC table and destination table size mismatch.");
+ 
+-  for (size_t i = 0; i < std::size(kDefaultDcTable); ++i) {
+-    const JpegHuffmanTable& dcTable = UNSAFE_TODO(kDefaultDcTable[i]);
+-    const JpegHuffmanTable& acTable = UNSAFE_TODO(kDefaultAcTable[i]);
+-    UNSAFE_TODO(huff_table_param->load_huffman_table[i]) = true;
+  auto load_huffman_table = base::span(huff_table_param->load_huffman_table);
+  static_assert(load_huffman_table.size() == huffman_tables.size(),
+                "Destination table sizes do not match.");
+
+  for (size_t i = 0; i < kDefaultDcTable.size(); ++i) {
+    const JpegHuffmanTable& dcTable = kDefaultDcTable[i];
+    const JpegHuffmanTable& acTable = kDefaultAcTable[i];
+    load_huffman_table[i] = true;
+ 
+     // Load DC Table.
+-    SafeArrayMemcpy(
+-        UNSAFE_TODO(huff_table_param->huffman_table[i]).num_dc_codes,
+-        dcTable.code_length);
+    auto num_dc_codes = base::span(huffman_tables[i].num_dc_codes);
+    static_assert(num_dc_codes.size() == dcTable.code_length.size());
+    num_dc_codes.copy_from_nonoverlapping(dcTable.code_length);
+     // |code_values| of JpegHuffmanTable needs to hold DC and AC code values
+     // so it has different size than
+     // |huff_table_param->huffman_table[i].dc_values|. Therefore we can't use
+     // SafeArrayMemcpy() here.
+-    static_assert(
+-        std::extent<decltype(huff_table_param->huffman_table[i].dc_values)>() <=
+-            std::extent<decltype(dcTable.code_value)>(),
+-        "DC table code value array too small.");
+-    UNSAFE_TODO(memcpy(huff_table_param->huffman_table[i].dc_values,
+-                       &dcTable.code_value[0],
+-                       sizeof(huff_table_param->huffman_table[i].dc_values)));
+    auto dc_values = base::span(huffman_tables[i].dc_values);
+    static_assert(dc_values.size() <= dcTable.code_value.size());
+    dc_values.copy_from_nonoverlapping(
+        base::span(dcTable.code_value).first(dc_values.size()));
+ 
+     // Load AC Table.
+-    SafeArrayMemcpy(
+-        UNSAFE_TODO(huff_table_param->huffman_table[i]).num_ac_codes,
+-        acTable.code_length);
+-    SafeArrayMemcpy(UNSAFE_TODO(huff_table_param->huffman_table[i]).ac_values,
+-                    acTable.code_value);
+-
+-    UNSAFE_TODO(memset(huff_table_param->huffman_table[i].pad, 0,
+-                       sizeof(huff_table_param->huffman_table[i].pad)));
+    auto num_ac_codes = base::span(huffman_tables[i].num_ac_codes);
+    static_assert(num_ac_codes.size() == acTable.code_length.size());
+    num_ac_codes.copy_from_nonoverlapping(acTable.code_length);
+
+    auto ac_values = base::span(huffman_tables[i].ac_values);
+    static_assert(ac_values.size() == acTable.code_value.size());
+    ac_values.copy_from_nonoverlapping(acTable.code_value);
+
+    std::ranges::fill(huffman_tables[i].pad, 0);
+   }
+ }
+ 
+@@ -287,11 +290,11 @@ size_t FillJpegHeader(const gfx::Size& input_size,
+     // Type (4-bit high) = 0:DC, Index (4-bit low).
+     header[idx++] = static_cast<uint8_t>(i);
+ 
+-    const JpegHuffmanTable& dcTable = UNSAFE_TODO(kDefaultDcTable[i]);
+    const JpegHuffmanTable& dcTable = kDefaultDcTable[i];
+     for (size_t j = 0; j < kNumDcRunSizeBits; ++j)
+-      header[idx++] = UNSAFE_TODO(dcTable.code_length[j]);
+      header[idx++] = dcTable.code_length[j];
+     for (size_t j = 0; j < kNumDcCodeWordsHuffVal; ++j)
+-      header[idx++] = UNSAFE_TODO(dcTable.code_value[j]);
+      header[idx++] = dcTable.code_value[j];
+ 
+     // AC Table.
+     UNSAFE_TODO(
+@@ -301,11 +304,11 @@ size_t FillJpegHeader(const gfx::Size& input_size,
+     // Type (4-bit high) = 1:AC, Index (4-bit low).
+     header[idx++] = 0x10 | static_cast<uint8_t>(i);
+ 
+-    const JpegHuffmanTable& acTable = UNSAFE_TODO(kDefaultAcTable[i]);
+    const JpegHuffmanTable& acTable = kDefaultAcTable[i];
+     for (size_t j = 0; j < kNumAcRunSizeBits; ++j)
+-      header[idx++] = UNSAFE_TODO(acTable.code_length[j]);
+      header[idx++] = acTable.code_length[j];
+     for (size_t j = 0; j < kNumAcCodeWordsHuffVal; ++j)
+-      header[idx++] = UNSAFE_TODO(acTable.code_value[j]);
+      header[idx++] = acTable.code_value[j];
+   }
+ 
+   // Start of Scan.
+diff --git a/media/parsers/jpeg_parser.cc b/media/parsers/jpeg_parser.cc
+index e5ace9db6d4e8..ddd501e0821a0 100644
+--- a/media/parsers/jpeg_parser.cc
+++ b/media/parsers/jpeg_parser.cc
+@@ -36,62 +36,65 @@
+ 
+ namespace media {
+ 
+-const JpegHuffmanTable kDefaultDcTable[kJpegMaxHuffmanTableNumBaseline] = {
+-    // luminance DC coefficients
+-    {
+-        true,
+-        {0, 1, 5, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0},
+-        {0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a,
+-         0x0b},
+-    },
+-    // chrominance DC coefficients
+-    {
+-        true,
+-        {0, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0},
+-        {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0xa, 0xb},
+-    },
+-};
+-
+-const JpegHuffmanTable kDefaultAcTable[kJpegMaxHuffmanTableNumBaseline] = {
+-    // luminance AC coefficients
+-    {
+-        true,
+-        {0, 2, 1, 3, 3, 2, 4, 3, 5, 5, 4, 4, 0, 0, 1, 0x7d},
+-        {0x01, 0x02, 0x03, 0x00, 0x04, 0x11, 0x05, 0x12, 0x21, 0x31, 0x41, 0x06,
+-         0x13, 0x51, 0x61, 0x07, 0x22, 0x71, 0x14, 0x32, 0x81, 0x91, 0xa1, 0x08,
+-         0x23, 0x42, 0xb1, 0xc1, 0x15, 0x52, 0xd1, 0xf0, 0x24, 0x33, 0x62, 0x72,
+-         0x82, 0x09, 0x0a, 0x16, 0x17, 0x18, 0x19, 0x1a, 0x25, 0x26, 0x27, 0x28,
+-         0x29, 0x2a, 0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x43, 0x44, 0x45,
+-         0x46, 0x47, 0x48, 0x49, 0x4a, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59,
+-         0x5a, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x73, 0x74, 0x75,
+-         0x76, 0x77, 0x78, 0x79, 0x7a, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89,
+-         0x8a, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0xa2, 0xa3,
+-         0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6,
+-         0xb7, 0xb8, 0xb9, 0xba, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9,
+-         0xca, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9, 0xda, 0xe1, 0xe2,
+-         0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xf1, 0xf2, 0xf3, 0xf4,
+-         0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa},
+-    },
+-    // chrominance AC coefficients
+-    {
+-        true,
+-        {0, 2, 1, 2, 4, 4, 3, 4, 7, 5, 4, 4, 0, 1, 2, 0x77},
+-        {0x00, 0x01, 0x02, 0x03, 0x11, 0x04, 0x05, 0x21, 0x31, 0x06, 0x12, 0x41,
+-         0x51, 0x07, 0x61, 0x71, 0x13, 0x22, 0x32, 0x81, 0x08, 0x14, 0x42, 0x91,
+-         0xa1, 0xb1, 0xc1, 0x09, 0x23, 0x33, 0x52, 0xf0, 0x15, 0x62, 0x72, 0xd1,
+-         0x0a, 0x16, 0x24, 0x34, 0xe1, 0x25, 0xf1, 0x17, 0x18, 0x19, 0x1a, 0x26,
+-         0x27, 0x28, 0x29, 0x2a, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3a, 0x43, 0x44,
+-         0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x53, 0x54, 0x55, 0x56, 0x57, 0x58,
+-         0x59, 0x5a, 0x63, 0x64, 0x65, 0x66, 0x67, 0x68, 0x69, 0x6a, 0x73, 0x74,
+-         0x75, 0x76, 0x77, 0x78, 0x79, 0x7a, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
+-         0x88, 0x89, 0x8a, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a,
+-         0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xb2, 0xb3, 0xb4,
+-         0xb5, 0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
+-         0xc8, 0xc9, 0xca, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9, 0xda,
+-         0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xf2, 0xf3, 0xf4,
+-         0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa},
+-    },
+-};
+const std::array<JpegHuffmanTable, kJpegMaxHuffmanTableNumBaseline>
+    kDefaultDcTable = {{
+        // luminance DC coefficients
+        {
+            true,
+            {0, 1, 5, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0, 0, 0},
+            {{0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0a,
+              0x0b}},
+        },
+        // chrominance DC coefficients
+        {
+            true,
+            {0, 3, 1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 0, 0, 0, 0},
+            {{0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 0xa, 0xb}},
+        },
+    }};
+const std::array<JpegHuffmanTable, kJpegMaxHuffmanTableNumBaseline>
+    kDefaultAcTable = {{
+        // luminance AC coefficients
+        {
+            true,
+            {0, 2, 1, 3, 3, 2, 4, 3, 5, 5, 4, 4, 0, 0, 1, 0x7d},
+            {{0x01, 0x02, 0x03, 0x00, 0x04, 0x11, 0x05, 0x12, 0x21, 0x31, 0x41,
+              0x06, 0x13, 0x51, 0x61, 0x07, 0x22, 0x71, 0x14, 0x32, 0x81, 0x91,
+              0xa1, 0x08, 0x23, 0x42, 0xb1, 0xc1, 0x15, 0x52, 0xd1, 0xf0, 0x24,
+              0x33, 0x62, 0x72, 0x82, 0x09, 0x0a, 0x16, 0x17, 0x18, 0x19, 0x1a,
+              0x25, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x34, 0x35, 0x36, 0x37, 0x38,
+              0x39, 0x3a, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a, 0x53,
+              0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5a, 0x63, 0x64, 0x65, 0x66,
+              0x67, 0x68, 0x69, 0x6a, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78, 0x79,
+              0x7a, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a, 0x92, 0x93,
+              0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0xa2, 0xa3, 0xa4, 0xa5,
+              0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7,
+              0xb8, 0xb9, 0xba, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7, 0xc8, 0xc9,
+              0xca, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9, 0xda, 0xe1,
+              0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xf1, 0xf2,
+              0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa}},
+        },
+        // chrominance AC coefficients
+        {
+            true,
+            {0, 2, 1, 2, 4, 4, 3, 4, 7, 5, 4, 4, 0, 1, 2, 0x77},
+            {{0x00, 0x01, 0x02, 0x03, 0x11, 0x04, 0x05, 0x21, 0x31, 0x06, 0x12,
+              0x41, 0x51, 0x07, 0x61, 0x71, 0x13, 0x22, 0x32, 0x81, 0x08, 0x14,
+              0x42, 0x91, 0xa1, 0xb1, 0xc1, 0x09, 0x23, 0x33, 0x52, 0xf0, 0x15,
+              0x62, 0x72, 0xd1, 0x0a, 0x16, 0x24, 0x34, 0xe1, 0x25, 0xf1, 0x17,
+              0x18, 0x19, 0x1a, 0x26, 0x27, 0x28, 0x29, 0x2a, 0x35, 0x36, 0x37,
+              0x38, 0x39, 0x3a, 0x43, 0x44, 0x45, 0x46, 0x47, 0x48, 0x49, 0x4a,
+              0x53, 0x54, 0x55, 0x56, 0x57, 0x58, 0x59, 0x5a, 0x63, 0x64, 0x65,
+              0x66, 0x67, 0x68, 0x69, 0x6a, 0x73, 0x74, 0x75, 0x76, 0x77, 0x78,
+              0x79, 0x7a, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87, 0x88, 0x89, 0x8a,
+              0x92, 0x93, 0x94, 0x95, 0x96, 0x97, 0x98, 0x99, 0x9a, 0xa2, 0xa3,
+              0xa4, 0xa5, 0xa6, 0xa7, 0xa8, 0xa9, 0xaa, 0xb2, 0xb3, 0xb4, 0xb5,
+              0xb6, 0xb7, 0xb8, 0xb9, 0xba, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
+              0xc8, 0xc9, 0xca, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7, 0xd8, 0xd9,
+              0xda, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7, 0xe8, 0xe9, 0xea, 0xf2,
+              0xf3, 0xf4, 0xf5, 0xf6, 0xf7, 0xf8, 0xf9, 0xfa}},
+        },
+    }};
+ 
+ constexpr uint8_t kZigZag8x8[64] = {
+     0,  1,  8,  16, 9,  2,  3,  10, 17, 24, 32, 25, 18, 11, 4,  5,
+@@ -265,8 +268,9 @@ static bool ParseDHT(base::span<const uint8_t> buffer,
+     if (!reader.ReadCopy(table->code_length)) {
+       return false;
+     }
+-    for (size_t i = 0; i < std::size(table->code_length); i++)
+-      count += UNSAFE_TODO(table->code_length[i]);
+    for (uint8_t code_len : table->code_length) {
+      count += code_len;
+    }
+ 
+     if (!InRange(count, 0u, sizeof(table->code_value))) {
+       DVLOG(1) << "Invalid code count " << count;
+@@ -354,8 +358,8 @@ static bool ParseSOS(base::span<const uint8_t> buffer,
+ // EOI marker) after search succeeds. Returns true on EOI marker found, or false
+ // otherwise.
+ static bool SearchEOI(base::span<const uint8_t> buffer,
+-                      const char** eoi_begin_ptr,
+-                      const char** eoi_end_ptr) {
+                      const unsigned char** eoi_begin_ptr,
+                      const unsigned char** eoi_end_ptr) {
+   DCHECK(eoi_begin_ptr);
+   DCHECK(eoi_end_ptr);
+   auto reader = base::SpanReader(buffer);
+@@ -393,9 +397,8 @@ static bool SearchEOI(base::span<const uint8_t> buffer,
+       case JPEG_RST7:
+         break;
+       case JPEG_EOI: {
+-        auto buffer_chars = base::as_chars(buffer);
+-        *eoi_begin_ptr = buffer_chars.subspan(marker1_in_buffer).data();
+-        *eoi_end_ptr = buffer_chars.subspan(reader.num_read()).data();
+        *eoi_begin_ptr = &buffer[marker1_in_buffer];
+        *eoi_end_ptr = reader.remaining_span().data();
+         return true;
+       }
+       default:
+@@ -524,9 +527,7 @@ static bool ParseSOI(base::span<const uint8_t> buffer,
+   }
+ 
+   // Scan data follows scan header immediately.
+-  auto remain = base::as_chars(reader.remaining_span());
+-  result->data = remain.data();
+-  result->data_size = remain.size();
+  result->data = reader.remaining_span();
+   return true;
+ }
+ 
+@@ -549,22 +550,22 @@ bool ParseJpegPicture(base::span<const uint8_t> buffer,
+   if (!ParseSOI(reader.remaining_span(), result)) {
+     return false;
+   }
+-  base::span<const uint8_t> result_span = base::as_bytes(
+-      // TODO(crbug.com/40284755): Make this span part of JpegParseResult.
+-      UNSAFE_TODO(base::span(result->data, result->data_size)));
+ 
+-  // Update the sizes: |result->data_size| should not include the EOI marker or
+  // Update the sizes: |result->data| should not include the EOI marker or
+   // beyond.
+-  const char* eoi_begin_ptr = nullptr;
+-  const char* eoi_end_ptr = nullptr;
+-  if (!SearchEOI(result_span, &eoi_begin_ptr, &eoi_end_ptr)) {
+  const unsigned char* eoi_begin_ptr = nullptr;
+  const unsigned char* eoi_end_ptr = nullptr;
+  if (!SearchEOI(result->data, &eoi_begin_ptr, &eoi_end_ptr)) {
+     DLOG(ERROR) << "SearchEOI failed";
+     return false;
+   }
+   DCHECK(eoi_begin_ptr);
+   DCHECK(eoi_end_ptr);
+-  result->data_size = eoi_begin_ptr - result->data;
+-  result->image_size = eoi_end_ptr - base::as_chars(buffer).data();
+
+  ptrdiff_t scan_data_size = eoi_begin_ptr - result->data.data();
+  CHECK_GE(scan_data_size, 0);
+  result->data = result->data.first(base::checked_cast<size_t>(scan_data_size));
+  result->image_size = eoi_end_ptr - buffer.data();
+   return true;
+ }
+ 
+diff --git a/media/parsers/jpeg_parser.h b/media/parsers/jpeg_parser.h
+index 874284a99b6da..0d03664402347 100644
+--- a/media/parsers/jpeg_parser.h
+++ b/media/parsers/jpeg_parser.h
+@@ -11,6 +11,7 @@
+ #include <array>
+ 
+ #include "base/containers/span.h"
+#include "base/memory/raw_span.h"
+ #include "media/base/media_export.h"
+ 
+ namespace media {
+@@ -80,17 +81,19 @@ const size_t kJpegMaxQuantizationTableNum = 4;
+ // Parsing result of JPEG DHT marker.
+ struct JpegHuffmanTable {
+   bool valid;
+-  uint8_t code_length[16];
+-  uint8_t code_value[162];
+  std::array<uint8_t, 16> code_length;
+  std::array<uint8_t, 162> code_value;
+ };
+ 
+ // K.3.3.1 "Specification of typical tables for DC difference coding"
+ MEDIA_EXPORT
+-extern const JpegHuffmanTable kDefaultDcTable[kJpegMaxHuffmanTableNumBaseline];
+extern const std::array<JpegHuffmanTable, kJpegMaxHuffmanTableNumBaseline>
+    kDefaultDcTable;
+ 
+ // K.3.3.2 "Specification of typical tables for AC coefficient coding"
+ MEDIA_EXPORT
+-extern const JpegHuffmanTable kDefaultAcTable[kJpegMaxHuffmanTableNumBaseline];
+extern const std::array<JpegHuffmanTable, kJpegMaxHuffmanTableNumBaseline>
+    kDefaultAcTable;
+ 
+ // Parsing result of JPEG DQT marker.
+ struct JpegQuantizationTable {
+@@ -141,9 +144,7 @@ struct JpegParseResult {
+   JpegQuantizationTable q_table[kJpegMaxQuantizationTableNum];
+   uint16_t restart_interval;
+   JpegScanHeader scan;
+-  const char* data;
+-  // The size of compressed data of the first image.
+-  size_t data_size;
+  base::raw_span<const uint8_t> data;
+   // The size of the first entire image including header.
+   size_t image_size;
+ };
+diff --git a/media/parsers/jpeg_parser_unittest.cc b/media/parsers/jpeg_parser_unittest.cc
+index d446cf93a92e6..8f5d9a8bb2c16 100644
+--- a/media/parsers/jpeg_parser_unittest.cc
+++ b/media/parsers/jpeg_parser_unittest.cc
+@@ -77,7 +77,7 @@ TEST(JpegParserTest, Parsing) {
+   EXPECT_EQ(3, result.scan.components[2].component_selector);
+   EXPECT_EQ(1, result.scan.components[2].dc_selector);
+   EXPECT_EQ(1, result.scan.components[2].ac_selector);
+-  EXPECT_EQ(121148u, result.data_size);
+  EXPECT_EQ(121148u, result.data.size());
+   EXPECT_EQ(121358u, result.image_size);
+ }
+ 
+@@ -100,7 +100,7 @@ TEST(JpegParserTest, TrailingZerosShouldBeIgnored) {
+   // Verify selected fields
+ 
+   // SOS fields
+-  EXPECT_EQ(121148u, result.data_size);
+  EXPECT_EQ(121148u, result.data.size());
+   EXPECT_EQ(121358u, result.image_size);
+ }
+ 
--- a/chromium.changes
+++ b/chromium.changes
@@ -1,3 +1,57 @@
+-------------------------------------------------------------------
+Fri Feb 13 19:51:45 UTC 2026 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- Chromium 145.0.7632.75:
+  * CVE-2026-2441: Use after free in CSS (boo#1258185)
+
+-------------------------------------------------------------------
+Fri Feb 13 17:21:22 UTC 2026 - Andreas Stieger <andreas.stieger@gmx.de>
+
+- Chromium 145.0.7632.67:
+  * Revert a change in url_fixer that may have caused crashes
+
+-------------------------------------------------------------------
+Wed Feb  4 22:46:39 UTC 2026 - Ruediger Oertel <ro@suse.com>
+
+- Chromium 145.0.7632.45 (boo#1258116)
+  * jpeg-xl support has been readded
+  * CVE-2026-2313: Use after free in CSS
+  * CVE-2026-2314: Heap buffer overflow in Codecs
+  * CVE-2026-2315: Inappropriate implementation in WebGPU
+  * CVE-2026-2316: Insufficient policy enforcement in Frames
+  * CVE-2026-2317: Inappropriate implementation in Animation
+  * CVE-2026-2318: Inappropriate implementation in PictureInPicture
+  * CVE-2026-2319: Race in DevTools
+  * CVE-2026-2320: Inappropriate implementation in File input
+  * CVE-2026-2321: Use after free in Ozone
+  * CVE-2026-2322: Inappropriate implementation in File input
+  * CVE-2026-2323: Inappropriate implementation in Downloads
+- modified patches:
+  * chromium-127-rust-clanglib.patch (context)
+  * chromium-144-revert-libxml-2.13.patch (context)
+  * ppc-fedora-0001-Force-baseline-POWER8-AltiVec-VSX-CPU-features-when-.patch
+    (context)
+  * ppc-debian-0003-third_party-ffmpeg-Add-ppc64-generated-config.patch
+    (drop ref to ppc/lossless_audiodsp_altivec.o, dropped upstream)
+  * chromium-141-no_cxx_modules.patch
+  * ppc-fedora-0001-Add-PPC64-support-for-boringssl.patch (context)
+  * ppc-fedora-0002-regenerate-xnn-buildgn.patch (regenerated)
+  * system-libdrm.patch (context)
+  * ppc-fedora-0002-third_party-libvpx-Remove-bad-ppc64-config.patch
+- added patches:
+  * chromium-145-blink_missing_include.patch
+  * chromium-145-use_unrar.patch
+    (properly respect disabling unrar in recent code changes)
+  * ppc-fedora-0009-sandbox-ignore-byte-span-error.patch
+  * chromium-4f46f03a6c6d4c6efc1ad5d0d78030d02326f967.patch
+    (revert spanification for jpeg_parser ending in compile error)
+  * chromium-24264eefbfd3464161764f31a2752c5327719452.patch
+    (also to revert jpeg_encoder spanification for older llvm)
+- bump BR for gn to 0.20251217
+  * need the string_hash function for rust gni
+- add rollup binaries for arm64 and powerpc64le, missing upstream
+  using tarballs from npm.skia.org
+
 -------------------------------------------------------------------
 Wed Feb  4 09:55:40 UTC 2026 - Ruediger Oertel <ro@suse.com>

--- a/chromium.spec
+++ b/chromium.spec
@@ -1,7 +1,7 @@
 #
 # spec file for package chromium
 #
-# Copyright (c) 2025 SUSE LLC
+# Copyright (c) 2026 SUSE LLC
 # Copyright (c) 2024 Callum Farmer <gmbr3@opensuse.org>
 # Copyright (c) 2026 Andreas Stieger <Andreas.Stieger@gmx.de>
 #
@@ -75,8 +75,10 @@
 %endif
 # GCC version
 %define gcc_version 14
-# esbuild version
+# minimal esbuild version
 %define esbuild_version 0.25.1
+# minimal gn version
+%define gn_version 0.20251217
 %if 0%{?suse_version} <= 1699
 %bcond_with system_webp
 %bcond_with system_re2
@@ -127,7 +129,7 @@
 %global official_build 1

 Name:           chromium%{n_suffix}
-Version:        144.0.7559.132
+Version:        145.0.7632.75
 Release:        0
 Summary:        Google's open source browser project
 License:        BSD-3-Clause AND LGPL-2.1-or-later
@@ -145,6 +147,10 @@ Source104:      chromium-symbolic.svg
 Source105:      INSTALL.sh
 #
 Source106:      chrome-wrapper
+# upstream only contains x86 binary still needed:
+Source201:      https://npm.skia.org/chrome-devtools/@rollup%2frollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.22.4.tgz
+Source202:      https://npm.skia.org/chrome-devtools/@rollup%2frollup-linux-powerpc64le-gnu/-/rollup-linux-powerpc64le-gnu-4.22.4.tgz
+# global patches
 Patch0:         chromium-libusb_interrupt_event_handler.patch
 # PATCH-FIX-OPENSUSE Make the 1-click-install ymp file always download [bnc#836059]
 Patch1:         exclude_ymp.patch
@@ -184,6 +190,8 @@ Patch386:       chromium-143-libpng-unbundle.patch
 Patch387:       chromium-143-cookie_string_view.patch
 Patch389:       chromium-143-revert_rust_is_multiple_of.patch
 Patch390:       chromium-144-revert_gfx_value_or.patch
+Patch391:       chromium-145-blink_missing_include.patch
+Patch392:       chromium-145-use_unrar.patch
 Patch393:       force-rust-nightly.patch
 # conditionally applied patches ppc64le only
 Patch401:       ppc-fedora-add-ppc64-architecture-string.patch
@@ -244,6 +252,7 @@ Patch458:       ppc-fedora-0001-add-xnn-ppc64el-support.patch
 # https://src.fedoraproject.org/rpms/chromium/blob/rawhide/f/0002-regenerate-xnn-buildgn.patch
 Patch459:       ppc-fedora-0002-regenerate-xnn-buildgn.patch
 Patch460:       ppc-debian-0003-third_party-ffmpeg-Add-ppc64-generated-config.patch
+Patch461:       ppc-fedora-0009-sandbox-ignore-byte-span-error.patch
 # conditionally applied patches
 # patch where libxml < 2.12
 Patch1010:      chromium-124-system-libxml.patch
@@ -254,6 +263,11 @@ Patch1040:      gtk-414.patch
 Patch1041:      gtk-414-2.patch
 # flac is too old
 Patch1050:      chromium-140-old-flac.patch
+# revert upstream patch ending in compile error
+# error: static assertion expression is not an integral constant expression
+Patch1060:       chromium-24264eefbfd3464161764f31a2752c5327719452.patch
+Patch1061:       chromium-4f46f03a6c6d4c6efc1ad5d0d78030d02326f967.patch
+
 # end conditionally applied patches
 BuildRequires:  SDL-devel
 BuildRequires:  bison
@@ -263,7 +277,7 @@ BuildRequires:  elfutils
 BuildRequires:  fdupes
 BuildRequires:  flex
 BuildRequires:  git
-BuildRequires:  gn >= 0.20250619
+BuildRequires:  gn >= %{gn_version}
 BuildRequires:  gperf
 BuildRequires:  hicolor-icon-theme
 BuildRequires:  golang(API)
@@ -279,8 +293,8 @@ BuildRequires:  nasm
 BuildRequires:  ninja >= 1.7.2
 BuildRequires:  pam-devel
 BuildRequires:  pkgconfig
-%if 0%{?suse_version} >= 1600
-BuildRequires:  nodejs-common
+%if 0%{?suse_version} >= 1600 || 0%{?sle_version} >= 150700
+BuildRequires:  nodejs-default
 %else
 BuildRequires:  nodejs22
 %endif
@@ -522,6 +536,22 @@ WebDriver is an open source tool for automated testing of webapps across many br
 %patch -p1 -P 1050
 %endif

+clang_version="$(clang --version | sed -n 's/clang version //p')"
+if [[ $(echo ${clang_version} | cut -d. -f1) -lt 21 ]]; then
+%patch -p1 -R -P 1060
+%patch -p1 -R -P 1061
+fi
+
+# unpack rollup binary for aarch64
+%ifarch aarch64
+tar xf %{SOURCE201} && mv package third_party/devtools-frontend/src/node_modules/@rollup/rollup-linux-arm64-gnu
+%endif
+
+#unpack rollup binary for ppc64le
+%ifarch ppc64le
+tar xf %{SOURCE202} && mv package third_party/devtools-frontend/src/node_modules/@rollup/rollup-linux-powerpc64le-gnu
+%endif 
+
 %build
 # esbuild
 rm third_party/devtools-frontend/src/third_party/esbuild/esbuild
@@ -794,7 +824,6 @@ keeplibs=(
    third_party/webrtc/modules/third_party/fft
    third_party/webrtc/modules/third_party/g711
    third_party/webrtc/modules/third_party/g722
-    third_party/webrtc/rtc_base/third_party/sigslot
    third_party/webrtc/rtc_tools
    third_party/widevine
    third_party/woff2
--- a/ppc-debian-0003-third_party-ffmpeg-Add-ppc64-generated-config.patch
+++ b/ppc-debian-0003-third_party-ffmpeg-Add-ppc64-generated-config.patch
@@ -9384,7 +9384,7 @@ Index: chromium-141.0.7390.37/third_party/ffmpeg/ffmpeg_generated.gni
 ===================================================================
 --- chromium-141.0.7390.37.orig/third_party/ffmpeg/ffmpeg_generated.gni
 +++ chromium-141.0.7390.37/third_party/ffmpeg/ffmpeg_generated.gni
-@@ -469,6 +469,40 @@ if ((use_linux_config && current_cpu ==
+@@ -320,6 +320,39 @@
   ]
 }
 
@@ -9403,7 +9403,6 @@ Index: chromium-141.0.7390.37/third_party/ffmpeg/ffmpeg_generated.gni
 +    "libavcodec/ppc/h264chroma_init.c",
 +    "libavcodec/ppc/hpeldsp_altivec.c",
 +    "libavcodec/ppc/idctdsp.c",
-+    "libavcodec/ppc/lossless_audiodsp_altivec.c",
 +    "libavcodec/ppc/lossless_videodsp_altivec.c",
 +    "libavcodec/ppc/me_cmp.c",
 +    "libavcodec/ppc/mpegaudiodsp_altivec.c",
@@ -9423,8 +9422,8 @@ Index: chromium-141.0.7390.37/third_party/ffmpeg/ffmpeg_generated.gni
 +}
 +
 if ((current_cpu == "x64" && ffmpeg_branding == "Chrome") ||
-     (is_android && current_cpu == "x86" && ffmpeg_branding == "Chrome") ||
     (is_win && current_cpu == "x86" && ffmpeg_branding == "Chrome") ||
+     (use_linux_config && current_cpu == "x86" && ffmpeg_branding == "Chrome")) {
 Index: chromium-141.0.7390.37/third_party/ffmpeg/libavcodec/ppc/h264dsp_ppc.c
 ===================================================================
 --- /dev/null
--- a/ppc-fedora-0001-Add-PPC64-support-for-boringssl.patch
+++ b/ppc-fedora-0001-Add-PPC64-support-for-boringssl.patch
@@ -4169,9 +4169,9 @@ Index: chromium-138.0.7204.35/third_party/boringssl/src/crypto/fipsmodule/aes/in
 --- chromium-138.0.7204.35.orig/third_party/boringssl/src/crypto/fipsmodule/aes/internal.h
 +++ chromium-138.0.7204.35/third_party/boringssl/src/crypto/fipsmodule/aes/internal.h
@@ -81,6 +81,12 @@ inline int vpaes_capable(void) { return
- inline int vpaes_capable(void) { return CRYPTO_is_NEON_capable(); }
- #endif
- 
+ #define VPAES
+ #define VPAES_CBC
+ inline int vpaes_capable() { return CRYPTO_is_NEON_capable(); }
 +#elif defined(OPENSSL_PPC64LE)
 +#define HWAES
 +
@@ -4180,9 +4180,9 @@ Index: chromium-138.0.7204.35/third_party/boringssl/src/crypto/fipsmodule/aes/in
 +}
 #endif
 
- #endif  // !NO_ASM
+ #endif
@@ -501,6 +507,13 @@ void aes_gcm_dec_kernel(const uint8_t *i
-                         const u128 Htable[16]);
+                                    const AES_KEY *key, const u128 Htable[16]);
 #endif
 
 +#elif defined(OPENSSL_PPC64LE)
@@ -4214,7 +4214,7 @@ Index: chromium-138.0.7204.35/third_party/boringssl/src/crypto/fipsmodule/bn/bn.
@@ -330,6 +330,23 @@ int bn_expand(BIGNUM *bn, size_t bits) {
 }
 
- int bn_resize_words(BIGNUM *bn, size_t words) {
+ int bssl::bn_resize_words(BIGNUM *bn, size_t words) {
 +#if defined(OPENSSL_PPC64LE)
 +  // This is a workaround for a miscompilation bug in Clang 7.0.1 on POWER.
 +  // The unittests catch the miscompilation, if it occurs, and it manifests
@@ -4946,7 +4946,7 @@ Index: chromium-138.0.7204.35/third_party/boringssl/src/crypto/fipsmodule/aes/gc
 ===================================================================
 --- chromium-138.0.7204.35.orig/third_party/boringssl/src/crypto/fipsmodule/aes/gcm_test.cc
 +++ chromium-138.0.7204.35/third_party/boringssl/src/crypto/fipsmodule/aes/gcm_test.cc
-@@ -169,5 +169,15 @@ TEST(GCMTest, ABI) {
+@@ -169,6 +169,16 @@ TEST(GCMTest, ABI) {
     }
   }
 #endif
@@ -4962,6 +4962,7 @@ Index: chromium-138.0.7204.35/third_party/boringssl/src/crypto/fipsmodule/aes/gc
 +#endif  // GHASH_ASM_PPC64LE
 }
 #endif  // SUPPORTS_ABI_TEST && !OPENSSL_NO_ASM
+ 
 Index: chromium-138.0.7204.35/third_party/boringssl/src/crypto/rand/getrandom_fillin.h
 ===================================================================
 --- chromium-138.0.7204.35.orig/third_party/boringssl/src/crypto/rand/getrandom_fillin.h
@@ -6740,8 +6741,8 @@ Index: chromium-138.0.7204.35/third_party/boringssl/src/util/fipstools/delocate/
 +}
 +
 func isSynthesized(symbol string) bool {
- 	return strings.HasSuffix(symbol, "_bss_get") ||
- 		strings.HasPrefix(symbol, "BORINGSSL_bcm_text_")
+ 	return strings.HasSuffix(symbol, "_bss_get")
+ }
@@ -1872,6 +2348,8 @@ func detectProcessor(input inputFile) pr
 		switch instructionName {
 		case "movq", "call", "leaq":
--- a/ppc-fedora-0001-Force-baseline-POWER8-AltiVec-VSX-CPU-features-when-.patch
+++ b/ppc-fedora-0001-Force-baseline-POWER8-AltiVec-VSX-CPU-features-when-.patch
@@ -16,7 +16,7 @@ Index: chromium-130.0.6723.44/v8/BUILD.gn
   if (v8_current_cpu == "ppc64") {
     defines += [ "V8_TARGET_ARCH_PPC64" ]
     cflags += [ "-ffp-contract=off" ]
-    if (current_os == "aix") {
+-    if (current_os == "aix" && !is_clang) {
 +    if (current_os == "linux") {
 +        cflags += [
 +        # Enable usage of AltiVec, VSX, and other POWER8 and higher features
@@ -24,7 +24,7 @@ Index: chromium-130.0.6723.44/v8/BUILD.gn
 +        "-maltivec",
 +        "-mvsx",
 +      ]
-+    } else if (current_os == "aix") {
+    } else if (current_os == "aix" && !is_clang) {
       cflags += [
         # Work around AIX ceil, trunc and round oddities.
         "-mcpu=power5+",
--- a/ppc-fedora-0002-regenerate-xnn-buildgn.patch
+++ b/ppc-fedora-0002-regenerate-xnn-buildgn.patch
--- a/ppc-fedora-0002-third_party-libvpx-Remove-bad-ppc64-config.patch
+++ b/ppc-fedora-0002-third_party-libvpx-Remove-bad-ppc64-config.patch
@@ -2,7 +2,7 @@
 +++ /dev/null
@@ -1,186 +0,0 @@
 -/*
- *  Copyright (c) 2025 The WebM project authors. All Rights Reserved.
+- *  Copyright (c) 2026 The WebM project authors. All Rights Reserved.
 - *
 - *  Use of this source code is governed by a BSD-style license
 - *  that can be found in the LICENSE file in the root of the source
@@ -191,7 +191,7 @@
 +++ /dev/null
@@ -1,119 +0,0 @@
 -/*
- *  Copyright (c) 2025 The WebM project authors. All Rights Reserved.
+- *  Copyright (c) 2026 The WebM project authors. All Rights Reserved.
 - *
 - *  Use of this source code is governed by a BSD-style license
 - *  that can be found in the LICENSE file in the root of the source
@@ -311,7 +311,7 @@
 -#endif  // VP9_RTCD_H_
 --- chromium-136.0.7103.48.orig/third_party/libvpx/source/config/linux/ppc64/vpx_config.asm	2025/05/14 22:49:40	1.1
 +++ /dev/null
-@@ -1,107 +0,0 @@
+@@ -1,108 +0,0 @@
 -@ This file was created from a .asm file
 -@  using the ads2gas.pl script.
 -.syntax unified
@@ -354,6 +354,7 @@
 -.equ HAVE_LASX ,  0
 -.equ HAVE_VPX_PORTS ,  1
 -.equ HAVE_PTHREAD_H ,  1
+-.equ HAVE_PTHREAD_SETNAME_NP ,  1
 -.equ HAVE_UNISTD_H ,  0
 -.equ CONFIG_DEPENDENCY_TRACKING ,  1
 -.equ CONFIG_EXTERNAL_BUILD ,  1
@@ -434,7 +435,7 @@
 -const char *vpx_codec_build_config(void) {return cfg;}
 --- chromium-136.0.7103.48.orig/third_party/libvpx/source/config/linux/ppc64/vpx_config.h	2025/05/14 22:49:40	1.1
 +++ /dev/null
-@@ -1,116 +0,0 @@
+@@ -1,117 +0,0 @@
 -/* Copyright (c) 2011 The WebM project authors. All Rights Reserved. */
 -/*  */
 -/* Use of this source code is governed by a BSD-style license */
@@ -486,6 +487,7 @@
 -#define HAVE_LASX 0
 -#define HAVE_VPX_PORTS 1
 -#define HAVE_PTHREAD_H 1
+-#define HAVE_PTHREAD_SETNAME_NP 1
 -#define HAVE_UNISTD_H 0
 -#define CONFIG_DEPENDENCY_TRACKING 1
 -#define CONFIG_EXTERNAL_BUILD 1
@@ -555,7 +557,7 @@
 +++ /dev/null
@@ -1,858 +0,0 @@
 -/*
- *  Copyright (c) 2025 The WebM project authors. All Rights Reserved.
+- *  Copyright (c) 2026 The WebM project authors. All Rights Reserved.
 - *
 - *  Use of this source code is governed by a BSD-style license
 - *  that can be found in the LICENSE file in the root of the source
@@ -1416,7 +1418,7 @@
 +++ /dev/null
@@ -1,83 +0,0 @@
 -/*
- *  Copyright (c) 2025 The WebM project authors. All Rights Reserved.
+- *  Copyright (c) 2026 The WebM project authors. All Rights Reserved.
 - *
 - *  Use of this source code is governed by a BSD-style license
 - *  that can be found in the LICENSE file in the root of the source
--- a/ppc-fedora-0009-sandbox-ignore-byte-span-error.patch
+++ b/ppc-fedora-0009-sandbox-ignore-byte-span-error.patch
@@ -0,0 +1,15 @@
+--- a/sandbox/linux/syscall_broker/broker_host.cc
+++ b/sandbox/linux/syscall_broker/broker_host.cc
+@@ -287,7 +287,12 @@
+       return;
+     }
+     RAW_CHECK(reply->AddIntToMessage(0));
+#ifdef __powerpc64__
+    // kernel stat can be padded, triggering std::has_unique_object_representations_v to return false
+    RAW_CHECK(reply->AddDataToMessage(base::byte_span_from_ref(base::allow_nonunique_obj, sb)));
+#else
+     RAW_CHECK(reply->AddDataToMessage(base::byte_span_from_ref(sb)));
+#endif
+   } else {
+ #if defined(__NR_fstatat64)
+     DCHECK(command_type == COMMAND_STAT64);
--- a/rollup-linux-arm64-gnu-4.22.4.tgz
+++ b/rollup-linux-arm64-gnu-4.22.4.tgz
--- a/rollup-linux-powerpc64le-gnu-4.22.4.tgz
+++ b/rollup-linux-powerpc64le-gnu-4.22.4.tgz
--- a/system-libdrm.patch
+++ b/system-libdrm.patch
@@ -31,8 +31,8 @@ Index: chromium-142.0.7444.3/ui/ozone/platform/drm/gpu/hardware_display_controll
 ===================================================================
 --- chromium-142.0.7444.3.orig/ui/ozone/platform/drm/gpu/hardware_display_controller.cc
 +++ chromium-142.0.7444.3/ui/ozone/platform/drm/gpu/hardware_display_controller.cc
-@@ -19,7 +19,7 @@
- #include "base/metrics/histogram_macros.h"
+@@ -18,7 +18,7 @@
+ #include "base/logging.h"
 #include "base/trace_event/typed_macros.h"
 #include "components/viz/common/resources/shared_image_format_utils.h"
 -#include "third_party/libdrm/src/include/drm/drm_fourcc.h"