diff --git a/patches/chromium/cherry-pick-1227933.patch b/patches/chromium/cherry-pick-1227933.patch
index 3e2e7afdd3f0b..005dcea395532 100644
--- a/patches/chromium/cherry-pick-1227933.patch
+++ b/patches/chromium/cherry-pick-1227933.patch
@@ -1,6 +1,6 @@
 From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
 From: Koji Ishii <kojii@chromium.org>
-Date: Mon Jul 26 07:09:18 2021 +0000
+Date: Mon, 26 Jul 2021 07:09:18 +0000
 Subject: Fix nested inline box fragmentation
 
 This patch fixes when nested inline boxes are fragmented in a
@@ -39,10 +39,10 @@ Cr-Commit-Position: refs/branch-heads/4577@{#145}
 Cr-Branched-From: 761ddde228655e313424edec06497d0c56b0f3c4-refs/heads/master@{#902210}
 
 diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_box_state.cc b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_box_state.cc
-index 5503e6359eb4..502812f2dd91 100644
+index b257014513cb881d4531694b86c05fd21edb6732..ad7be2730fe88bbbfd3a9e78598cb5e123e58c76 100644
 --- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_box_state.cc
 +++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_box_state.cc
-@@ -486,13 +486,14 @@ void NGInlineLayoutStateStack::UpdateAfterReorder(
+@@ -387,13 +387,14 @@ void NGInlineLayoutStateStack::UpdateAfterReorder(
      box_data.fragment_start = box_data.fragment_end = 0;
  
    // Scan children and update start/end from their box_data_index.
@@ -62,7 +62,7 @@ index 5503e6359eb4..502812f2dd91 100644
  
  #if DCHECK_IS_ON()
    // Check all BoxData have ranges.
-@@ -509,7 +510,8 @@ void NGInlineLayoutStateStack::UpdateAfterReorder(
+@@ -410,7 +411,8 @@ void NGInlineLayoutStateStack::UpdateAfterReorder(
  
  unsigned NGInlineLayoutStateStack::UpdateBoxDataFragmentRange(
      NGLogicalLineItems* line_box,
@@ -72,7 +72,7 @@ index 5503e6359eb4..502812f2dd91 100644
    // Find the first line box item that should create a box fragment.
    for (; index < line_box->size(); index++) {
      NGLogicalLineItem* start = &(*line_box)[index];
-@@ -537,7 +539,7 @@ unsigned NGInlineLayoutStateStack::UpdateBoxDataFragmentRange(
+@@ -438,7 +440,7 @@ unsigned NGInlineLayoutStateStack::UpdateBoxDataFragmentRange(
        // It also changes other BoxData, but not the one we're dealing with here
        // because the update is limited only when its |box_data_index| is lower.
        while (end->box_data_index && end->box_data_index < box_data_index) {
@@ -81,7 +81,7 @@ index 5503e6359eb4..502812f2dd91 100644
        }
  
        if (box_data_index != end->box_data_index)
-@@ -552,14 +554,9 @@ unsigned NGInlineLayoutStateStack::UpdateBoxDataFragmentRange(
+@@ -453,14 +455,9 @@ unsigned NGInlineLayoutStateStack::UpdateBoxDataFragmentRange(
      } else {
        // This box is fragmented by BiDi reordering. Add a new BoxData for the
        // fragmented range.
@@ -99,7 +99,7 @@ index 5503e6359eb4..502812f2dd91 100644
      }
      // If this box has parent boxes, we need to process it again.
      if (box_data_list_[box_data_index - 1].parent_box_data_index)
-@@ -569,7 +566,43 @@ unsigned NGInlineLayoutStateStack::UpdateBoxDataFragmentRange(
+@@ -470,7 +467,43 @@ unsigned NGInlineLayoutStateStack::UpdateBoxDataFragmentRange(
    return index;
  }
  
@@ -145,10 +145,10 @@ index 5503e6359eb4..502812f2dd91 100644
      if (box_data.fragmented_box_data_index)
        box_data.UpdateFragmentEdges(box_data_list_);
 diff --git a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_box_state.h b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_box_state.h
-index 2e957ea901ab..558ae9993f87 100644
+index 82ecfef8fe4d404d5713f0f67d83b38ecfbfca4c..9d079266efd7f2ccc43cef40d8d89e4fc6edda9e 100644
 --- a/third_party/blink/renderer/core/layout/ng/inline/ng_inline_box_state.h
 +++ b/third_party/blink/renderer/core/layout/ng/inline/ng_inline_box_state.h
-@@ -187,17 +187,6 @@ class CORE_EXPORT NGInlineLayoutStateStack {
+@@ -156,17 +156,6 @@ class CORE_EXPORT NGInlineLayoutStateStack {
    // reordering.
    void UpdateAfterReorder(NGLogicalLineItems*);
  
@@ -166,8 +166,8 @@ index 2e957ea901ab..558ae9993f87 100644
    // Compute inline positions of fragments and boxes.
    LayoutUnit ComputeInlinePositions(NGLogicalLineItems*, LayoutUnit position);
  
-@@ -297,6 +286,19 @@ class CORE_EXPORT NGInlineLayoutStateStack {
-         NGLogicalLineItems*);
+@@ -259,6 +248,19 @@ class CORE_EXPORT NGInlineLayoutStateStack {
+     scoped_refptr<const NGLayoutResult> CreateBoxFragment(NGLogicalLineItems*);
    };
  
 +  // Update start/end of the first BoxData found at |index|.
@@ -188,7 +188,7 @@ index 2e957ea901ab..558ae9993f87 100644
  
 diff --git a/third_party/blink/web_tests/external/wpt/css/CSS2/text/crashtests/bidi-inline-fragment-oof-crash.html b/third_party/blink/web_tests/external/wpt/css/CSS2/text/crashtests/bidi-inline-fragment-oof-crash.html
 new file mode 100644
-index 000000000000..b701d2b5688a
+index 0000000000000000000000000000000000000000..b701d2b5688ace54aa99530c12fa8143f1e6a508
 --- /dev/null
 +++ b/third_party/blink/web_tests/external/wpt/css/CSS2/text/crashtests/bidi-inline-fragment-oof-crash.html
 @@ -0,0 +1,13 @@