[pull] master from chromium:master #16

pull · 2021-09-22T20:38:21Z

See Commits and Changes for more details.

Can you help keep this open source service alive? 💖 Please sponsor : )

Summary of changes available at: https://chromium.googlesource.com/v8/v8/+log/b923dba8..fbba2862 Please follow these instructions for assigning/CC'ing issues: https://v8.dev/docs/triage-issues Please close rolling in case of a roll revert: https://v8-roll.appspot.com/ This only works with a Google account. CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux-blink-rel CQ_INCLUDE_TRYBOTS=luci.chromium.try:linux_optional_gpu_tests_rel CQ_INCLUDE_TRYBOTS=luci.chromium.try:mac_optional_gpu_tests_rel CQ_INCLUDE_TRYBOTS=luci.chromium.try:win_optional_gpu_tests_rel CQ_INCLUDE_TRYBOTS=luci.chromium.try:android_optional_gpu_tests_rel R=hablich@chromium.org,vahl@chromium.org,v8-waterfall-sheriff@grotations.appspotmail.com Change-Id: Ic6f9ce48b760deb0cb04ecdad625ce913057b5d9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3173558 Bot-Commit: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: v8-ci-autoroll-builder <v8-ci-autoroll-builder@chops-service-accounts.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#923850}

Roll Chrome Linux PGO profile from chrome-linux-main-1632287417-ac511baa87b0d6ac3bb26fdb93f5680e38a96d9f.profdata to chrome-linux-main-1632311929-cb3dc9d89600f38a2ad0bd6b7e36196324f593f3.profdata If this roll has caused a breakage, revert this CL and stop the roller using the controls here: https://autoroll.skia.org/r/pgo-linux-chromium Please CC pgo-profile-sheriffs@google.com on the revert to ensure that a human is aware of the problem. To file a bug in Chromium main branch: https://bugs.chromium.org/p/chromium/issues/entry To report a problem with the AutoRoller itself, please file a bug: https://bugs.chromium.org/p/skia/issues/entry?template=Autoroller+Bug Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md Cq-Include-Trybots: luci.chrome.try:linux-chrome Tbr: pgo-profile-sheriffs@google.com Change-Id: I4b38e9ceb2fe8370255da055b051cdfbcc32612e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3174447 Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Bot-Commit: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#923851}

MediaQueryExpNode and subclasses can represent nested and compound expressions, which is needed to supports things like (not (a or b)). This CL just adds the class hierarchy and tests the serialization behavior. Actual evaluation will come later. Bug: 1034465, 442449 Change-Id: I7b72fc5537d52a6c59b3a5494c0abfeb455a658c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3168499 Commit-Queue: Anders Hartvoll Ruud <andruud@chromium.org> Reviewed-by: Kevin Babbitt <kbabbitt@microsoft.com> Cr-Commit-Position: refs/heads/main@{#923852}

Users need to have a way to revoke their approval of a web app protocol handler beside uninstalling the web app. This cl adds a section in chrome://settings/handlers to allow users to remove approved protocol handlers for web apps. Screenshot: https://imgur.com/a/zp9ZJtq Repro steps: 1) Enable enable-desktop-pwas-protocol-handling in about:flags. 2) Install https://mwjacksonmsft.github.io/pwa/display-standalone/index.html 3) Install https://fabiorocha.github.io/pwa/ 4) Launch app via protocol launch (web+testing://abc), 5) Check 'Remember my choice', and click 'Allow'. 6) Go to chrome://settings/handlers You should notice the new list in the handler page, and you can click the X to remove the item from the list, and should see the dialog if you repeat step (4) Skip-Translation-Screenshots-Check: True Bug: 1213620 Change-Id: Ie01e855731319454f4244421675875ed04185cc5 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3170834 Reviewed-by: Theodore Olsauskas-Warren <sauski@google.com> Reviewed-by: dpapad <dpapad@chromium.org> Reviewed-by: Daniel Murphy <dmurph@chromium.org> Reviewed-by: Mike Wasserman <msw@chromium.org> Commit-Queue: Mike Jackson <mjackson@microsoft.com> Cr-Commit-Position: refs/heads/main@{#923853}

Bug: 1251000 Change-Id: Id0ac60c5523a4e672cb44bc5c2b2f3e93332f3c2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3172882 Reviewed-by: Henrik Boström <hbos@chromium.org> Commit-Queue: Ilya Nikolaevskiy <ilnik@chromium.org> Cr-Commit-Position: refs/heads/main@{#923854}

Bring the operator<'s behavior more in line with that of Isequivalent. Centering on how SiteForCookies that are IsNull() are handled. Change-Id: Ie5edfb809680e3c72d3215848a0cc379194e937d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3173644 Reviewed-by: Maksim Orlovich <morlovich@chromium.org> Commit-Queue: Steven Bingler <bingler@chromium.org> Cr-Commit-Position: refs/heads/main@{#923855}

Release_Notes: http://go/eche-x20/relnotes/Main/eche_20210922_RC00.html https://chrome-infra-packages.appspot.com/p/chromeos_internal/apps/eche_app/app/+/vfSvt4_rJR0SPZGxGk0lSP-uaypLPoA6EeKstKVfZicC If this roll has caused a breakage, revert this CL and stop the roller using the controls here: https://skia-autoroll.corp.goog/r/eche-app-chromium Please CC eche-app@grotations.appspotmail.com on the revert to ensure that a human is aware of the problem. To report a problem with the AutoRoller itself, please file a bug: https://bugs.chromium.org/p/skia/issues/entry?template=Autoroller+Bug Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md Bug: None Tbr: eche-app@grotations.appspotmail.com Change-Id: I74b3fda40ffb501eb15b771d3071f4adf3cdc8fa Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3174440 Commit-Queue: chromium-internal-autoroll <chromium-internal-autoroll@skia-corp.google.com.iam.gserviceaccount.com> Bot-Commit: chromium-internal-autoroll <chromium-internal-autoroll@skia-corp.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#923856}

While investigating b/198412661, we needed to know in what state is the certificate provisioning worker is failing for a specific profile. The log message that is added in this CL will help in troubleshooting similar situations in the future. Bug: b/198740068 Change-Id: I5a859dcf61a2832731741a85ebdf857fd2bde1e2 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3162315 Commit-Queue: Omar Morsi <omorsi@google.com> Reviewed-by: Michael Ershov <miersh@google.com> Reviewed-by: Pavol Marko <pmarko@chromium.org> Cr-Commit-Position: refs/heads/main@{#923857}

This change implements the "pair new device" button within the Quick Settings, and hooks the button up so that the Bluetooth pairing dialog is opened when pressed. Tests are included to verify functionality. Enabled: https://screenshot.googleplex.com/7HGnu9YcNEcw8jG.png Disabled: https://screenshot.googleplex.com/3ed5qJUQjk3YEjK.png Bug: 1010321 Test: Verified on-device and locally with unit tests. Change-Id: Id0fc0668b5fff098ec21500f1faeb1b30d56f49a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3152964 Reviewed-by: James Cook <jamescook@chromium.org> Reviewed-by: Kyle Horimoto <khorimoto@chromium.org> Reviewed-by: Gordon Seto <gordonseto@google.com> Commit-Queue: Chad Duffin <chadduffin@chromium.org> Cr-Commit-Position: refs/heads/main@{#923858}

This is a reland of b02ce8a It tries to fix the "heap-use-after-free" in the unit test. See e.g. https://ci.chromium.org/ui/p/chromium/builders/ci/android-asan/13032/overview Original change's description: > [Autofill Assistant] Remove PDM from initial check > > This removes the reliance on PDM from the initial > data check to use the actual data we'll use in the > continuation of the flow. > > It also adds a test for UMA in this case. > > Bug: b/194991425 > Bug: b/181538193 > Change-Id: Ieccaf687824ee242b3d26d2f5cdcc197c1d6f054 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3171052 > Commit-Queue: Sandro Maggi <sandromaggi@google.com> > Reviewed-by: Luca Hunkeler <hluca@google.com> > Cr-Commit-Position: refs/heads/main@{#922858} Bug: b/200776699 Bug: b/181538193 Change-Id: Ia914adfa579fb12759c96facdb982d17dcafe4b9 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3172623 Auto-Submit: Sandro Maggi <sandromaggi@google.com> Commit-Queue: Luca Hunkeler <hluca@google.com> Reviewed-by: Luca Hunkeler <hluca@google.com> Cr-Commit-Position: refs/heads/main@{#923859}

Almost all uses of IsInMainFrame have been converted to IsInPrimaryMainFrame for MPArch. This CL adds a test to ensure that a non-primary page (like a prerendered one) does not display the intent picker. Bug: 1218946 Change-Id: Ic5f25c1078b79db022e7177368d41834c93b4bea Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3160751 Reviewed-by: Adithya Srinivasan <adithyas@chromium.org> Reviewed-by: Peter Boström <pbos@chromium.org> Commit-Queue: Liviu Tinta <liviutinta@chromium.org> Cr-Commit-Position: refs/heads/main@{#923860}

https://chrome-internal.googlesource.com/chrome/src-internal.git/+log/36ebb13c47bd..f1ede5354069 If this roll has caused a breakage, revert this CL and stop the roller using the controls here: https://skia-autoroll.corp.goog/r/src-internal-chromium-autoroll Please CC tnagel@google.com,nektar@google.com on the revert to ensure that a human is aware of the problem. To report a problem with the AutoRoller itself, please file a bug: https://bugs.chromium.org/p/skia/issues/entry?template=Autoroller+Bug Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md Cq-Include-Trybots: luci.chrome.try:linux-chromeos-chrome Bug: None Tbr: tnagel@google.com,nektar@google.com Change-Id: I56d48cecf02de1761484713db0860c0a61ea7021 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3175428 Commit-Queue: chromium-internal-autoroll <chromium-internal-autoroll@skia-corp.google.com.iam.gserviceaccount.com> Bot-Commit: chromium-internal-autoroll <chromium-internal-autoroll@skia-corp.google.com.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#923861}

https://dawn.googlesource.com/dawn.git/+log/a10f5331f2b5..f84e7b4edacd 2021-09-22 jiawei.shao@intel.com Remove prefix 'm' on mCreateInfo in ComputeVertexInputDesc If this roll has caused a breakage, revert this CL and stop the roller using the controls here: https://autoroll.skia.org/r/dawn-chromium-autoroll Please CC kainino@google.com on the revert to ensure that a human is aware of the problem. To file a bug in Dawn: https://bugs.chromium.org/p/dawn/issues/entry To file a bug in Chromium: https://bugs.chromium.org/p/chromium/issues/entry To report a problem with the AutoRoller itself, please file a bug: https://bugs.chromium.org/p/skia/issues/entry?template=Autoroller+Bug Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md Cq-Include-Trybots: luci.chromium.try:dawn-linux-x64-deps-rel;luci.chromium.try:dawn-mac-x64-deps-rel;luci.chromium.try:dawn-win10-x64-deps-rel;luci.chromium.try:dawn-win10-x86-deps-rel Bug: None Tbr: kainino@google.com Change-Id: I1faf6863032d5accd84201706e5fe390368ecf3a Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3174981 Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Bot-Commit: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#923862}

Screenshot: http://shortn/_qkDpV5SPyK Bug: 1125150 Change-Id: Ib5d2c58cedc38f59664546c38323b1146b951fbb Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3173341 Reviewed-by: Zentaro Kavanagh <zentaro@chromium.org> Commit-Queue: Michael Checo <michaelcheco@google.com> Cr-Commit-Position: refs/heads/main@{#923863}

- Remove the "bottom-nav-content" slot and add two new slots for the drawer and side panel. Bug: 1205539 Change-Id: I6602808e409844ba25433287ce7c1788c4c8bd41 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3171495 Reviewed-by: Jimmy Gong <jimmyxgong@chromium.org> Commit-Queue: Michael Checo <michaelcheco@google.com> Cr-Commit-Position: refs/heads/main@{#923864}

Screenshot: http://shortn/_kGP5dVWeYS Bug: 1197335 Change-Id: Ied349d605baac937adb7197240d8dd799bcfc88f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3173726 Reviewed-by: Zentaro Kavanagh <zentaro@chromium.org> Reviewed-by: Kyle Horimoto <khorimoto@chromium.org> Commit-Queue: Michael Checo <michaelcheco@google.com> Cr-Commit-Position: refs/heads/main@{#923865}

In crrev.com/c/3167270, UserAgentUtilsTest was changed to become a parameterized test, but we didn't update the Fuchsia expectations file. This caused the UserAgentStringOrdering test to fail on Fuchsia CI. This CL updates the expectations test file to account for the new test name. Bug: 1251660 Change-Id: Ia1c080ff40b0ee102a7bc4d6405255a6e91bf78c Fixed: 1251660 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3173560 Reviewed-by: Colin Blundell <blundell@chromium.org> Commit-Queue: Ali Beyad <abeyad@chromium.org> Cr-Commit-Position: refs/heads/main@{#923866}

This CL tests the child account's dynamic removal on the welcome screen. Bug: 1250658 Change-Id: If789616f44d8103b67c7b1a47785ff57aa5accc1 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3171061 Reviewed-by: Tanmoy Mollik <triploblastic@chromium.org> Commit-Queue: Alice Wang <aliceywang@chromium.org> Cr-Commit-Position: refs/heads/main@{#923867}

https://android.googlesource.com/platform/external/perfetto.git/+log/c4a2b1fa2b96..8f0fabf54bc9 If this roll has caused a breakage, revert this CL and stop the roller using the controls here: https://autoroll.skia.org/r/perfetto-trace-processor-win-chromium Please CC perfetto-bugs@google.com on the revert to ensure that a human is aware of the problem. To file a bug in Chromium: https://bugs.chromium.org/p/chromium/issues/entry To report a problem with the AutoRoller itself, please file a bug: https://bugs.chromium.org/p/skia/issues/entry?template=Autoroller+Bug Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md Tbr: perfetto-bugs@google.com Change-Id: I12a9cf86263caf5cd871082f91ae633cec4acf78 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3175382 Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Bot-Commit: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#923868}

Add a description for the 'items' policy annotation to the top of policy_templates.json. Bug: 1238852, b/200706794 Change-Id: Ib2338879b25ba698d243eac41ef3e63e5a9a647c Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3174171 Reviewed-by: Owen Min <zmin@chromium.org> Commit-Queue: Igor Ruvinov <igorruvinov@chromium.org> Cr-Commit-Position: refs/heads/main@{#923869}

…k button. Currently, opening the "Recent Tab" from the Start surface's menu will navigate the current Tab to the recent Tab's page. Thus, when tapping the back button, it will follow the navigation history, rather than back to the Start surface even though the menu was clicked from the Start surface's menu. To fix it, we create a new Tab with launch type FROM_START_SURFACE to open the recent Tab page. It will return to the previous overview page, either Start surface or GTS when tapping the back button, and the Tab will be deleted if tapping the back button direct on the recent Tab page. Demo before CL: https://drive.google.com/file/d/1JpbuIXmEo0QbbRnaMPg6gBD0fTKdX9iY/view?usp=sharing Demo after CL: https://drive.google.com/file/d/17d4arNzSAXznOtlbM3nzHOgl77MeOsG3/view?usp=sharing Bug: 1251391 Change-Id: I3e81e9f553e98c6969f3f7904cc373ffa1a4f26d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3171573 Reviewed-by: Yaron Friedman <yfriedman@chromium.org> Reviewed-by: Hao Dong <spdonghao@chromium.org> Commit-Queue: Xi Han <hanxi@chromium.org> Cr-Commit-Position: refs/heads/main@{#923870}

The UserAction was wrongly recorded. Disambiguate some enums and add missing ones. Bug: None Change-Id: Iacdb3f8861137d5c669a1cf4877f7e3eb1ed6265 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3172527 Reviewed-by: Mohammad Refaat <mrefaat@chromium.org> Commit-Queue: Gauthier Ambard <gambard@chromium.org> Cr-Commit-Position: refs/heads/main@{#923871}

This CL removes *bottomgroup in the SigninFirstRun MVC class names as this MVC now covers the whole screen of the SigninFirstRunFragment instead of the bottom group. Bug: 1248333 Change-Id: If5275902652bea9852ec23775310382ce9986931 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3172794 Reviewed-by: Tanmoy Mollik <triploblastic@chromium.org> Commit-Queue: Alice Wang <aliceywang@chromium.org> Cr-Commit-Position: refs/heads/main@{#923872}

This is a reland of d12ff51 On the linux-chromeos-chrome builder, the forced CHECK did not result in logged output (failed to create minidump) so the crash recognition sanity check was failing to find the token it expects. Changed the CHECK to a LOG(FATAL), which should ensure that the expected token is in the sub-test output. Original change's description: > Add end-to-end desktop testing for variations safe-mode. > > This CL adds a test which exercises variations safe-mode for crashes > that occur as a part of field-trial setup during start-up. > > The test is re-entrant to the browser_tests binary. The main test is > a control loop that configures a user-data-dir and "manually" runs a > series of (InProcessBrowserTest) sub-tests in order to exercise > extended variations safe-mode across multiple crashes during browser > startup. > > Bug: 1249256 > Change-Id: I1d15bad268d521d4206103773bce5cddaa90c3af > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3132823 > Reviewed-by: Caitlin Fischer <caitlinfischer@google.com> > Reviewed-by: Alexei Svitkine <asvitkine@chromium.org> > Commit-Queue: Roger McFarlane <rogerm@chromium.org> > Cr-Commit-Position: refs/heads/main@{#923126} Bug: 1249256 Change-Id: I90c5313072ffc1765431d49f30caf16ab8d6688e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3173639 Reviewed-by: Alexei Svitkine <asvitkine@chromium.org> Commit-Queue: Roger McFarlane <rogerm@chromium.org> Cr-Commit-Position: refs/heads/main@{#923873}

Bug: 1251880 Change-Id: Id898293044c90fa697b3a3253058faa4925c53df Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3174375 Auto-Submit: Yulun Wu <yulunwu@chromium.org> Commit-Queue: Alex Newcomer <newcomer@chromium.org> Reviewed-by: Alex Newcomer <newcomer@chromium.org> Cr-Commit-Position: refs/heads/main@{#923874}

https://webrtc.googlesource.com/src.git/+log/070dbe13d104..9def99487e3b 2021-09-22 nisse@webrtc.org Delete BasicPacketSocketFactory constructor with thread argument If this roll has caused a breakage, revert this CL and stop the roller using the controls here: https://autoroll.skia.org/r/webrtc-chromium-autoroll Please CC webrtc-chromium-sheriffs-robots@google.com on the revert to ensure that a human is aware of the problem. To file a bug in WebRTC: https://bugs.chromium.org/p/webrtc/issues/entry To file a bug in Chromium: https://bugs.chromium.org/p/chromium/issues/entry To report a problem with the AutoRoller itself, please file a bug: https://bugs.chromium.org/p/skia/issues/entry?template=Autoroller+Bug Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md Bug: None Tbr: webrtc-chromium-sheriffs-robots@google.com Change-Id: If4511b335ad73276712e91f9fa2649d709583f83 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3175524 Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Bot-Commit: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#923875}

Proxy settings on different platforms are monitored using platform specific implementations of ProxyConfigService (i.e. ProxyConfigServiceMac, ProxyConfigServiceWin, ProxyConfigServiceLinux etc.) which listens/polls proxy configs from the OS. This CL introduces the ProxyConfigServiceLacros which listens for proxy settings coming from Ash-Chrome via the mojo crosapi. The proxy configs are propagated to the browser's NetworkService only if the pref kUseAshProxy is true. If kUseAshProxy is false, the proxy config sent by Ash-Chrome is not used by the NetworkService. To keep the existing order of precedence, if a proxy is configured via an extension, it will have priority over the proxy config coming from Ash-Chrome, regardless of the value of kUseAshProxy. Not forcing secondary profiles to go through the system proxy is a privacy improvement, especially in a commercial deployment. In a follow-up CL we will add a UI checkbox to allow secondary profiles to opt-in on using the system proxy. For now, kUseAshProxy is always true for primary profiles and false for secondary profiles. Bug: b/192914999 Test: unit tests, browser test Change-Id: Icac55ce896caf0afe789b7a86c6b93093c1ed444 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3122991 Reviewed-by: Dominic Battré <battre@chromium.org> Reviewed-by: Roland Bock <rbock@google.com> Reviewed-by: Matt Menke <mmenke@chromium.org> Reviewed-by: Pavol Marko <pmarko@chromium.org> Commit-Queue: Andreea-Elena Costinas <acostinas@google.com> Cr-Commit-Position: refs/heads/main@{#923876}

This change adds logic to mediator that observers Fast Pair the UI broker, scanning broker, and pairing broker, and logs each event to a sparse histogram. What is logged is a number that corresponds to the order of the events that occur in the Fast Pair engagement flow based on go/chromeos-user-flow-metric. Change-Id: Id62b9a57b25460bd4bfc41f2271e064b6cf52497 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3159669 Reviewed-by: Zentaro Kavanagh <zentaro@chromium.org> Reviewed-by: Kyle Horimoto <khorimoto@chromium.org> Reviewed-by: Shane Fitzpatrick <shanefitz@google.com> Commit-Queue: Juliet Levesque <julietlevesque@google.com> Cr-Commit-Position: refs/heads/main@{#923877}

Bug: 1251576 Change-Id: Ieefa660d0eed5d5be976099087f3c745549ff5df Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3172620 Commit-Queue: Denis Kuznetsov [CET] <antrim@chromium.org> Reviewed-by: Roman Sorokin [CET] <rsorokin@chromium.org> Reviewed-by: Renato Silva <rrsilva@google.com> Cr-Commit-Position: refs/heads/main@{#923878}

https://skia.googlesource.com/skia.git/+log/1c5eb4b3713e..5480677cfc60 2021-09-22 jvanverth@google.com Fix CMAKE build 2021-09-22 johnstiles@google.com Migrate unreachable-code elimination to Analysis. 2021-09-22 skia-autoroll@skia-public.iam.gserviceaccount.com Roll ANGLE from 9184973fc1be to 68c0da839bc6 (13 revisions) 2021-09-22 skia-autoroll@skia-public.iam.gserviceaccount.com Roll Chromium from c3ac146 to 5b12d6f (500 revisions) 2021-09-22 skia-autoroll@skia-public.iam.gserviceaccount.com Roll SwiftShader from 6cbc24686901 to 755b78dc66b2 (2 revisions) 2021-09-22 skia-autoroll@skia-public.iam.gserviceaccount.com Roll Dawn from 92d6e53e6def to a10f5331f2b5 (5 revisions) 2021-09-21 johnstiles@google.com Revert "align the different implementations of 1/x" 2021-09-21 ethannicholas@google.com Removed unused SkSLPosition 2021-09-21 robertphillips@google.com Add SkSurface_Graphite stub 2021-09-21 johnstiles@google.com Fix SwitchWithFallthrough test on iOS. 2021-09-21 herb@google.com align the different implementations of 1/x If this roll has caused a breakage, revert this CL and stop the roller using the controls here: https://autoroll.skia.org/r/skia-autoroll Please CC brianosman@google.com on the revert to ensure that a human is aware of the problem. To file a bug in Skia: https://bugs.chromium.org/p/skia/issues/entry To file a bug in Chromium: https://bugs.chromium.org/p/chromium/issues/entry To report a problem with the AutoRoller itself, please file a bug: https://bugs.chromium.org/p/skia/issues/entry?template=Autoroller+Bug Documentation for the AutoRoller is here: https://skia.googlesource.com/buildbot/+doc/main/autoroll/README.md Cq-Include-Trybots: luci.chromium.try:android_optional_gpu_tests_rel;luci.chromium.try:linux-blink-rel;luci.chromium.try:linux-chromeos-compile-dbg;luci.chromium.try:linux_optional_gpu_tests_rel;luci.chromium.try:mac_optional_gpu_tests_rel;luci.chromium.try:win_optional_gpu_tests_rel Cq-Do-Not-Cancel-Tryjobs: true Bug: None Tbr: brianosman@google.com Test: Test: Test: BufferDataTest.MapWriteArrayBufferDataDrawArrays Test: Test: Test: BufferDataTest.MapWriteArrayBufferDataDrawQuad Test: Test: Test: ComputeShaderTest.ImageBufferMapWrite Test: Test: Test: TextureBufferTestES31.MapTextureBufferInvalidateThenWrite Test: Test: Test: VulkanPerformanceCounterTest.MappingGpuReadOnlyBufferGhostsBuffer Change-Id: I890ec02cdbe4a39ebe410598ddff4f774b899602 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3174448 Commit-Queue: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Bot-Commit: chromium-autoroll <chromium-autoroll@skia-public.iam.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#923879}

This reverts commit 842626c. Reason for revert: [sheriff] suspected to cause multiple failures in SafetyTipPageInfoBubbleViewBrowserTests on linux-ubsan-vptr: https://ci.chromium.org/p/chromium/builders/ci/linux-ubsan-vptr/6970 Sample failure: [ RUN ] All/SafetyTipPageInfoBubbleViewBrowserTest.BubbleWaitsForVisible/1 [...] ../../chrome/browser/ui/views/page_info/safety_tip_page_info_bubble_view_browsertest.cc:390:23: runtime error: downcast of address 0x180601885e00 which does not point to an object of type 'PageInfoBubbleView' 0x180601885e00: note: object is of type 'PageInfoNewBubbleView' 00 00 00 00 18 70 11 10 50 56 00 00 80 68 50 01 06 18 00 00 b8 00 00 00 30 00 00 00 00 00 00 00 ^~~~~~~~~~~~~~~~~~~~~~~ vptr for 'PageInfoNewBubbleView' #0 0x564ffa77d440 in SafetyTipPageInfoBubbleViewBrowserTest::CheckPageInfoShowsSafetyTipInfo(Browser*, security_state::SafetyTipStatus, GURL const&) chrome/browser/ui/views/page_info/safety_tip_page_info_bubble_view_browsertest.cc:390:23 #1 0x564ffa788397 in SafetyTipPageInfoBubbleViewBrowserTest_BubbleWaitsForVisible_Test::RunTestOnMainThread() chrome/browser/ui/views/page_info/safety_tip_page_info_bubble_view_browsertest.cc:837:3 #2 0x565002ae1026 in content::BrowserTestBase::ProxyRunTestOnMainThreadLoop() content/public/test/browser_test_base.cc:868:7 #3 0x565001aae15a in Run base/callback.h:142:12 #4 0x565001aae15a in ChromeBrowserMainParts::PreMainMessageLoopRunImpl() chrome/browser/chrome_browser_main.cc:1745:38 #5 0x565001aaba50 in ChromeBrowserMainParts::PreMainMessageLoopRun() chrome/browser/chrome_browser_main.cc:1083:18 #6 0x564ffd8e2f00 in content::BrowserMainLoop::PreMainMessageLoopRun() content/browser/browser_main_loop.cc:957:28 #7 0x564ffe307f82 in Run base/callback.h:142:12 #8 0x564ffe307f82 in content::StartupTaskRunner::RunAllTasksNow() content/browser/startup_task_runner.cc:41:29 #9 0x564ffd8e2368 in content::BrowserMainLoop::CreateStartupTasks() content/browser/browser_main_loop.cc:865:25 #10 0x564ffd8e889c in content::BrowserMainRunnerImpl::Initialize(content::MainFunctionParams const&) content/browser/browser_main_runner_impl.cc:131:15 #11 0x564ffd8dec1e in content::BrowserMain(content::MainFunctionParams const&) content/browser/browser_main.cc:45:32 #12 0x564fff2a06e8 in content::RunBrowserProcessMain(content::MainFunctionParams const&, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:641:10 #13 0x564fff2a2e90 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams&, bool) content/app/content_main_runner_impl.cc:1137:10 #14 0x564fff2a1f18 in content::ContentMainRunnerImpl::Run(bool) content_main_runner_impl.cc #15 0x564fff29dde0 in content::RunContentProcess(content::ContentMainParams const&, content::ContentMainRunner*) content_main.cc #16 0x564fff29e7dd in content::ContentMain(content::ContentMainParams const&) content_main.cc #17 0x565002adfcff in content::BrowserTestBase::SetUp() content/public/test/browser_test_base.cc:712:3 #18 0x5650018271c4 in InProcessBrowserTest::SetUp() chrome/test/base/in_process_browser_test.cc:401:20 #19 0x564ffa79d759 in SafetyTipPageInfoBubbleViewBrowserTest::SetUp() chrome/browser/ui/views/page_info/safety_tip_page_info_bubble_view_browsertest.cc:306:27 #20 0x564ffb8f8c7d in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc:2701:3 #21 0x564ffb8fa600 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2885:11 #22 0x564ffb8fc1bb in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3044:30 #23 0x564ffb9115ca in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:5903:44 #24 0x564ffb90fd8c in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc:5470:10 #25 0x565001a12e28 in RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2492:46 #26 0x565001a12e28 in base::TestSuite::Run() base/test/test_suite.cc:445:16 #27 0x5650017d0bac in ChromeTestSuiteRunner::RunTestSuiteInternal(ChromeTestSuite*) chrome/test/base/chrome_test_launcher.cc:88:22 #28 0x5650017d0c1b in ChromeTestSuiteRunner::RunTestSuite(int, char**) chrome_test_launcher.cc #29 0x565002b8529b in content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:409:31 #30 0x5650017d11b1 in LaunchChromeTests(unsigned long, content::TestLauncherDelegate*, int, char**) chrome/test/base/chrome_test_launcher.cc:284:10 #31 0x5650017c9dcc in main chrome/test/base/browser_tests_main.cc:61:10 #32 0x7fc242b01bf6 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21bf6) #33 0x564ff76da7e9 in _start (/b/s/w/ir/out/Release/browser_tests+0xe8af7e9) SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../chrome/browser/ui/views/page_info/safety_tip_page_info_bubble_view_browsertest.cc:390:23 in Original change's description: > Enable PageInfoV2Desktop by default > > Enable flag and remove testing config. > > Bug: 1188101 > Change-Id: Ifd839436f3d4c0127d15b449bbca84855ccd858f > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3217207 > Reviewed-by: Balazs Engedy <engedy@chromium.org> > Reviewed-by: Christian Dullweber <dullweber@chromium.org> > Reviewed-by: Theodore Olsauskas-Warren <sauski@google.com> > Reviewed-by: Xinghui Lu <xinghuilu@chromium.org> > Commit-Queue: Olesia Marukhno <olesiamarukhno@google.com> > Cr-Commit-Position: refs/heads/main@{#931972} Bug: 1188101 Change-Id: Ic51b9fdc730b7046e24b4d394248218b86eef09d No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3226638 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Alex Moshchuk <alexmos@chromium.org> Owners-Override: Alex Moshchuk <alexmos@chromium.org> Cr-Commit-Position: refs/heads/main@{#932067}

… off" This reverts commit 7db902d. Reason for revert: [sheriff] suspected to cause multiple AccountProfileMapperTest failures on linux-lacros-tester-rel: First failing build: https://ci.chromium.org/p/chromium/builders/ci/linux-lacros-tester-rel/16078 Sample failure: [ RUN ] AccountProfileMapperTest.RemovePrimaryAccountFromPrimaryProfile Received signal 11 SEGV_MAPERR 209300000105 #0 0x5584a2716cd9 base::debug::CollectStackTrace() #1 0x5584a2684db3 base::debug::StackTrace::StackTrace() #2 0x5584a2716823 base::debug::(anonymous namespace)::StackDumpSignalHandler() #3 0x7f9750773980 (/lib/x86_64-linux-gnu/libpthread-2.27.so+0x1297f) #4 0x5584a269ec4c base::internal::WeakReference::IsValid() #5 0x55849d569978 base::ObserverList<>::RemoveObserver() #6 0x5584a2edaf01 ProfileAccountManager::Shutdown() #7 0x5584a377e0bc DependencyManager::PerformInterlockedTwoPhaseShutdown() #8 0x5584a1be43ae TestingProfile::~TestingProfile() #9 0x55849cf239ae (anonymous namespace)::PermissionManagerTestingProfile::~PermissionManagerTestingProfile() #10 0x5584a2d094bf ProfileDestroyer::DestroyOriginalProfileNow() #11 0x5584a2d091ed ProfileDestroyer::DestroyProfileWhenAppropriate() #12 0x5584a2d1a886 ProfileManager::ProfileInfo::~ProfileInfo() #13 0x5584a1be6fef std::__1::__tree<>::destroy() #14 0x5584a2d1ca09 ProfileManager::~ProfileManager() #15 0x5584a1be14ae FakeProfileManager::~FakeProfileManager() #16 0x5584a1be5d12 TestingProfileManager::~TestingProfileManager() #17 0x55849dc1309b AccountProfileMapperTest_GetAccounts_Test::~AccountProfileMapperTest_GetAccounts_Test() #18 0x55849ef2f92c testing::TestInfo::Run() #19 0x55849ef30617 testing::TestSuite::Run() Original change's description: > [Lacros] Do not create AccountProfileMapper if the feature is off > > AccountProfileMapper should only be created if the > kMultiProfileAccountConsistency feature is enabled. Otherwise, it might > have negative side-effects like deleting user profiles. > > To add a DCHECK(kMultiProfileAccountConsistency) to > AccountProfileMapper, > this CL also enables kMultiProfileAccountConsistency in all related > unit tests. This appears to be a non-trivial task because ProfileManager > will now create its own instance of AccountProfileMapper that doesn't > use an AccountManagerFacade mock. > > This CL adds a TestingProfileManager::SetAccountProfileMapper() methods > to inject a fake instance for testing. > > Bug: 1226045 > Change-Id: I69f74aed3f4bd9bdb107912d5e92872d53691a07 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3222809 > Reviewed-by: David Roger <droger@chromium.org> > Commit-Queue: Alex Ilin <alexilin@chromium.org> > Cr-Commit-Position: refs/heads/main@{#931942} Bug: 1226045 Change-Id: If5ee60910f6cba1aabc407dba814448f538a2d39 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3227179 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Alex Moshchuk <alexmos@chromium.org> Owners-Override: Alex Moshchuk <alexmos@chromium.org> Cr-Commit-Position: refs/heads/main@{#932071}

This CL changes the aura::WindowObserver hook used in exo::ExtendedDragSource: Previously, ExtendedDragSource::OnWindowVisibilityChanging() was used to call ash::ToplevelWindowEventHandler::AttemptToStartDrag(), and kick off the drag 'n drop. Problem is that for the scenario of TabletMode ON and WebUITabStrip OFF, using OnWindowVisibilityChanging() hook is too early. Reason: In today's ToT, when a window detaches, during a tab drag 'n drop, the following check takes place and fails, causing the whole operation to abort (see lines 309-310 below): 295 std::unique_ptr<WindowResizer> CreateWindowResizerForTabletMode( 296 aura::Window* window, ...) { (...) 306 WindowState* window_state = WindowState::Get(window); 307 // Only maximized/fullscreen/snapped window can be dragged from 308 // the top of the screen. 309 if (!window_state->IsMaximized() && !window_state->IsFullscreen() 310 && !window_state->IsSnapped()) { 311 return nullptr; This happens because the |window_state| in case is only set to MAXIMIZED from a code that uses OnWindowVisibilityChanged() hook: (...) #12 0x7fe849164dda TabletModeWindowManager::OnWindowVisibilityChanged() (...) #15 0x7fe8520d2be3 aura::Window::NotifyWindowVisibilityChanged() #16 0x7fe8520cdf2c aura::Window::SetVisibleInternal() #17 0x7fe8520cdc54 aura::Window::Show() #18 0x7fe84cfcf013 views::NativeWidgetAura::Show() #19 0x7fe84cf89398 views::Widget::Show() #20 0x561eee1cb154 exo::ShellSurfaceBase::CommitWidget() #21 0x561eee1cacf6 exo::ShellSurfaceBase::OnSurfaceCommit() Hence, using OnDraggedWindowVisibilityChanging() in exo::ExtendedDragSource class is too early. This CL changes the hook used to OnWindowVisibilityChanged(), and also sets the following aura::Window properties, used by the drag 'n drop logic: ash::kTabDraggingSourceWindowKey and ash::kIsDraggingTabsKey. With this change, the functionality starts to take shape, and it is possible to drag the window around. Snapping and merge-back are still not fully functional (see follow up CLs). R=oshima@chromium.org BUG=1252941 Change-Id: I8600652a974210e3081e97d6d65639582ad222ad Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3254858 Reviewed-by: Mitsuru Oshima <oshima@chromium.org> Commit-Queue: Antonio Gomes <tonikitoo@igalia.com> Cr-Commit-Position: refs/heads/main@{#939226}

It turns out that exo::ExtendedDragSource class can benefit from overriding both OnWindowVisibilityChanging() and OnWindowVisibilityChanged() hooks. In [1], the use of OnWindowVisibilityChanging() hook was changed by OnWindowVisibilityChanged(), since according to the existing Ash's drag'n drop logic, by the time ash::ToplevelWindowEventHandler::AttemptToStartDrag() is called the window state should be up to date, something that occurs in ash::TabletModeWindowManager::OnWindowVisibilityChanged(). However, it turns how that Lacros needs to set ash::kIsDraggingTabsKey property as soon as possible, so that undesirable window resizes don't take place during the drag'n drop beginning - causing the window to flicker. This CL reintroduces OnWindowVisibilityChanging() hook, and moves some of the logic in OnWindowVisibilityChanged() into it, In practice, it avoids Lacros from flicking when starting a drag'n drop (see stack trace below) [1] https://crrev.com/c/3254858 #9 0x7f8f4dda154a ash::TabletModeWindowState::UpdateBounds() <-- calls aura::Window::SetBounds() #10 0x7f8f4dda0e0e ash::TabletModeWindowState::UpdateWindow() #11 0x7f8f4dda16ef ash::TabletModeWindowState::AttachState() #12 0x7f8f4ddcd304 ash::WindowState::SetStateObject() #13 0x7f8f4dda03b1 ash::TabletModeWindowState::TabletModeWindowState() #14 0x7f8f4dd98830 ash::TabletModeWindowManager::TrackWindow() #15 0x7f8f4dd995a7 ash::TabletModeWindowManager::OnWindowVisibilityChanged() #16 0x7f8f4ff664fc aura::Window::NotifyWindowVisibilityChangedAtReceiver() #17 0x7f8f4ff661c6 aura::Window::NotifyWindowVisibilityChangedDown() #18 0x7f8f4ff652d7 aura::Window::NotifyWindowVisibilityChanged() #19 0x7f8f4ff6002a aura::Window::SetVisibleInternal() #20 0x7f8f4ff5fcaa aura::Window::Show() #21 0x7f8f4f371b3b views::NativeWidgetAura::Show() #22 0x7f8f4f3260b8 views::Widget::Show() #23 0x55d01acb6fd6 exo::ShellSurfaceBase::CommitWidget() #24 0x55d01acb6b78 exo::ShellSurfaceBase::OnSurfaceCommit() #25 0x55d01ac7d90d exo::Surface::Commit() (..) BUG=1252941 R=oshima@chromium.org Change-Id: Ib6ba73d3bb2a90a3ac180c974f292bec39c1b3d4 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3365554 Reviewed-by: Mitsuru Oshima <oshima@chromium.org> Commit-Queue: Antonio Gomes <tonikitoo@igalia.com> Cr-Commit-Position: refs/heads/main@{#955327}

This reverts commit 6ff1599. Reason for revert: Seems to have caused browser_test failures on linux-chromeos-chrome https://ci.chromium.org/p/chrome/builders/ci/linux-chromeos-chrome/19698 rowserTestBase received signal: Segmentation fault. Backtrace: #0 0x563ae696f899 base::debug::CollectStackTrace() #1 0x563ae68d6683 base::debug::StackTrace::StackTrace() #2 0x563ae6ff8293 content::(anonymous namespace)::DumpStackTraceSignalHandler() #3 0x7f9ac9026040 (/lib/x86_64-linux-gnu/libc-2.27.so+0x3f03f) #4 0x563ae7720266 PrefChangeRegistrar::RemoveAll() #5 0x563ae7720222 PrefChangeRegistrar::~PrefChangeRegistrar() #6 0x563ae2f37095 std::__1::unique_ptr<>::reset() #7 0x563ae3696a1b policy::ActiveDirectoryMigrationManager::~ActiveDirectoryMigrationManager() #8 0x563ae3696a38 policy::ActiveDirectoryMigrationManager::~ActiveDirectoryMigrationManager() #9 0x563ae369a699 policy::BrowserPolicyConnectorAsh::~BrowserPolicyConnectorAsh() #10 0x563ae369a6fe policy::BrowserPolicyConnectorAsh::~BrowserPolicyConnectorAsh() #11 0x563ae6a0edbd BrowserProcessImpl::~BrowserProcessImpl() #12 0x563ae6a0edea BrowserProcessImpl::~BrowserProcessImpl() #13 0x563ae6a668e9 browser_shutdown::ShutdownPostThreadsStop() #14 0x563ae6a0e226 ChromeBrowserMainParts::PostDestroyThreads() #15 0x563ae349ef9b ash::ChromeBrowserMainPartsAsh::PostDestroyThreads() #16 0x563ae495d2d9 content::BrowserMainLoop::ShutdownThreadsAndCleanUp() #17 0x563ae495e53c content::BrowserMainRunnerImpl::Shutdown() #18 0x563ae495a9ce content::BrowserMain() #19 0x563ae555e819 content::RunBrowserProcessMain() #20 0x563ae555f8e0 content::ContentMainRunnerImpl::RunBrowser() #21 0x563ae555f431 content::ContentMainRunnerImpl::Run() #22 0x563ae555d209 content::RunContentProcess() #23 0x563ae555d861 content::ContentMain() #24 0x563ae6ff6f2b content::BrowserTestBase::SetUp() #25 0x563ae68bf947 InProcessBrowserTest::SetUp() #26 0x563ae3b0fbed testing::Test::Run() #27 0x563ae3b10520 testing::TestInfo::Run() #28 0x563ae3b10ce1 testing::TestSuite::Run() #29 0x563ae3b1a61a testing::internal::UnitTestImpl::RunAllTests() #30 0x563ae3b1a219 testing::UnitTest::Run() #31 0x563ae69d5af8 base::TestSuite::Run() #32 0x563ae688bfa1 BrowserTestSuiteRunnerChromeOS::RunTestSuite() #33 0x563ae70407b7 content::LaunchTests() #34 0x563ae688e77a LaunchChromeTests() #35 0x563ae688bf23 main #36 0x7f9ac9008bf7 __libc_start_main #37 0x563ae134462a _start Original change's description: > Remote powerwash on Chromad via policy > > Implement remote powerwash on Chromad, using the recently added > ChromadToCloudMigrationEnabled policy. The powerwash will be used to > start the migration of AD managed devices into cloud management. Besides > having the new policy enabled, the device needs to be on the login > screen and the enrollment ID must have already been uploaded to > DMServer. > > Bug: 1209246 > Change-Id: I6a67b8a8a43c28bc5f03f27e96d0415f69b6bc83 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3141873 > Reviewed-by: Maksim Ivanov <emaxx@chromium.org> > Reviewed-by: Roman Sorokin <rsorokin@chromium.org> > Reviewed-by: Colin Blundell <blundell@chromium.org> > Commit-Queue: Felipe Andrade <fsandrade@chromium.org> > Cr-Commit-Position: refs/heads/main@{#959123} Bug: 1209246 Change-Id: If067abcf2a9289ebacaeb240b1f67749c305509c No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3389555 Auto-Submit: Scott Violet <sky@chromium.org> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#959243}

This reverts commit 65b9357. Reason for revert: Made linux-chromeos-rel very unhappy First failure: https://ci.chromium.org/ui/p/chromium/builders/ci/linux-chromeos-rel/54339/overview Example stack trace: BrowserTestBase received signal: Segmentation fault. Backtrace: #0 0x5602878b1df9 base::debug::CollectStackTrace() #1 0x560287814a63 base::debug::StackTrace::StackTrace() #2 0x560287f236f9 content::(anonymous namespace)::DumpStackTraceSignalHandler() #3 0x7f5dca479040 (/lib/x86_64-linux-gnu/libc-2.27.so+0x3f03f) #4 0x56028382eb06 std::__1::__tree<>::__erase_unique<>() #5 0x5602849cda7e crosapi::BrowserManager::StopKeepAlive() #6 0x5602877e163f std::__1::unique_ptr<>::reset() #7 0x5602877e0fa2 crosapi::test::AshBrowserTestStarter::~AshBrowserTestStarter() #8 0x5602877ff1b3 std::__1::unique_ptr<>::reset() #9 0x560287f22469 content::BrowserTestBase::SetUp() #10 0x5602877fd219 InProcessBrowserTest::SetUp() #11 0x560284bb448d testing::Test::Run() #12 0x560284bb4e28 testing::TestInfo::Run() #13 0x560284bb55e3 testing::TestSuite::Run() #14 0x560284bbecd5 testing::internal::UnitTestImpl::RunAllTests() #15 0x560284bbe8e7 testing::UnitTest::Run() #16 0x560287919f5a base::TestSuite::Run() #17 0x5602877c996f BrowserTestSuiteRunnerChromeOS::RunTestSuite() #18 0x560287f6ba53 content::LaunchTests() #19 0x5602877cc08e LaunchChromeTests() #20 0x5602877c98f1 main #21 0x7f5dca45bbf7 __libc_start_main #22 0x56028236e7ea _start Original change's description: > Make Lacros lifetime closer to real use. > > We started to enable Lacros's KeepAlive for AppService. > Following that, now AshBrowserTestStarter uses it to make it > closer to the real use cases. > > To avoid name conflict, put AshBrowserTestStarter to crosapi::test > namespace. > > BUG=1277898 > TEST=Ran browser_tests. > > Change-Id: I007e2cf5dc75cf581b3fdca595c18b2a9fbc8c5c > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3386527 > Reviewed-by: Sven Zheng <svenzheng@chromium.org> > Reviewed-by: David Tseng <dtseng@chromium.org> > Commit-Queue: Hidehiko Abe <hidehiko@chromium.org> > Cr-Commit-Position: refs/heads/main@{#960880} Bug: 1277898 Change-Id: I5d1b9053bb82d0a5593f8ffaf5a70ff66cd72618 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3401559 Auto-Submit: Leonard Grey <lgrey@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Owners-Override: Leonard Grey <lgrey@chromium.org> Commit-Queue: Leonard Grey <lgrey@chromium.org> Cr-Commit-Position: refs/heads/main@{#960983}

… from "client area" This CL pairs up Lacros with other "Browser apps", where a ash::WindowResizer instance can only be created if the dragging takes place the HTCAPTION area. In practice: When starting to drag Lacros from the bezel area, in tablet mode, with WebUITabStrip OFF, the following stacktrace takes place: #2 0x5bead006f22f exo::ShellSurface::Configure() #3 0x5bead1373b06 wm::FocusController::SetActiveWindow() #4 0x5bead1372cc9 wm::FocusController::FocusAndActivateWindow() (..) #12 0x5bead1508967 ash::OverviewController::StartOverview() #13 0x5bead1569bcc ash::TabletModeWindowDragDelegate::StartWindowDrag() #14 0x5bead1563e41 ash::CreateWindowResizer() #15 0x5bead154679b ash::ToplevelWindowEventHandler::PrepareForDrag() #16 0x5bead15460f6 ash::ToplevelWindowEventHandler::AttemptToStartDrag() #17 0x5bead1545ab1 ash::ToplevelWindowEventHandler::OnGestureEvent() In ShellSurface::Configure(), a |pending_configs_| entry is added with HTCLIENT "resize component" (which comes from frame #17 above). Next call to exo::Surface::Commit() executes the following stacktrace, which does not expect |resize_component_| to be HTCLIENT, and hits an DCHECK. #4 0x5bead007159b exo::ShellSurface::GetSurfaceOrigin() #5 0x5bead00712c9 exo::ShellSurface::GetWidgetBounds() #6 0x5bead00750a2 exo::ShellSurfaceBase::UpdateWidgetBounds() #7 0x5bead0075448 exo::ShellSurfaceBase::CommitWidget() #8 0x5bead00752f6 exo::ShellSurfaceBase::OnSurfaceCommit() #9 0x5bead005cfa3 exo::Surface::Commit() BUG=1315609 R=oshima@chromium.org Change-Id: I2ba817b110206f29025707b2763ebf5ab0bc7ada Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3594761 Reviewed-by: Mitsuru Oshima <oshima@chromium.org> Commit-Queue: Antonio Gomes <tonikitoo@igalia.com> Cr-Commit-Position: refs/heads/main@{#994156}

ash::Shell::Get() will CHECK-fail if Shell has been deleted. Use ash::Shell::HasInstance() instead. This avoids the following shutdown CHECK failure: 2022-07-13T17:10:21.129726Z FATAL chrome[174352:174352]: [shell.cc(292)] Check failed: instance_. #0 0x7f22df90bd12 base::debug::CollectStackTrace() #1 0x7f22df800ac3 base::debug::StackTrace::StackTrace() #2 0x7f22df81f1dd logging::LogMessage::~LogMessage() #3 0x7f22df81fc1e logging::LogMessage::~LogMessage() #4 0x7f22d9d5e3e7 ash::Shell::Get() #5 0x563bad18bf43 KeyboardBacklightColorMetricsProvider::ProvideCurrentSessionData() #6 0x563badc31d04 metrics::DelegatingProvider::ProvideCurrentSessionData() #7 0x563badc3762d metrics::MetricsLog::RecordCurrentSessionData() #8 0x563badc3a156 metrics::MetricsService::CloseCurrentLog() #9 0x563badc38e3b metrics::MetricsService::DisableRecording() #10 0x563bad72cf35 ChromeBrowserMainParts::PostMainMessageLoopRun() #11 0x563bacd9e251 ash::ChromeBrowserMainPartsAsh::PostMainMessageLoopRun() #12 0x7f22d8267f7f content::BrowserMainLoop::ShutdownThreadsAndCleanUp() #13 0x7f22d826998c content::BrowserMainRunnerImpl::Shutdown() #14 0x7f22d826563d content::BrowserMain() #15 0x7f22d8b656d6 content::RunBrowserProcessMain() #16 0x7f22d8b66a7e content::ContentMainRunnerImpl::RunBrowser() #17 0x7f22d8b66601 content::ContentMainRunnerImpl::Run() #18 0x7f22d8b645f8 content::RunContentProcess() #19 0x7f22d8b646b9 content::ContentMain() #20 0x563babe99ca0 ChromeMain #21 0x7f22cbf9f7fd __libc_start_main #22 0x563babe99ada _start Bug: none Change-Id: If65c0f90a37c09c405340d675a15e2c9ca9685b8 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3759374 Commit-Queue: Jason Thai <jasontt@chromium.org> Reviewed-by: Jason Thai <jasontt@chromium.org> Auto-Submit: James Cook <jamescook@chromium.org> Commit-Queue: James Cook <jamescook@chromium.org> Cr-Commit-Position: refs/heads/main@{#1023829}

This reverts commit 0ae1202. Reason for revert: causes consistent failures on MSAN bots example links: (two different bots) https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20ChromiumOS%20MSan%20Tests/29604/overview https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20MSan%20Tests/34158/overview All the failures I checked involve use-of-uninitialized-value example failure: HeadlessScriptControllerImplTest.StartFailsIfNoScriptsAvailable https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20ChromiumOS%20MSan%20Tests/29604/overview [ RUN ] HeadlessScriptControllerImplTest.StartFailsIfNoScriptsAvailable GMOCK WARNING: Uninteresting mock function call - returning default value. Function call: RegisterSyntheticFieldTrial({ 'A' (65, 0x41), 'u' (117, 0x75), 't' (116, 0x74), 'o' (111, 0x6F), 'f' (102, 0x66), 'i' (105, 0x69), 'l' (108, 0x6C), 'l' (108, 0x6C), 'A' (65, 0x41), 's' (115, 0x73), 's' (115, 0x73), 'i' (105, 0x69), 's' (115, 0x73), 't' (116, 0x74), 'a' (97, 0x61), 'n' (110, 0x6E), 't' (116, 0x74), 'T' (84, 0x54), 'r' (114, 0x72), 'i' (105, 0x69), 'g' (103, 0x67), 'g' (103, 0x67), 'e' (101, 0x65), 'r' (114, 0x72), 'e' (101, 0x65), 'd' (100, 0x64) }, { 'E' (69, 0x45), 'n' (110, 0x6E), 'a' (97, 0x61), 'b' (98, 0x62), 'l' (108, 0x6C), 'e' (101, 0x65), 'd' (100, 0x64) }) Returns: false NOTE: You can safely ignore the above warning unless this call should not happen. Do not suppress it by blindly adding an EXPECT_CALL() if you don't mean to enforce the call. See https://github.com/google/googletest/blob/master/docs/gmock_cook_book.md#knowing-when-to-expect for details. ==20593==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x5573fb8250a1 in autofill_assistant::StartupUtil::ChooseStartupModeForIntent(autofill_assistant::TriggerContext const&, autofill_assistant::StartupUtil::Options const&) const ./../../components/autofill_assistant/browser/startup_util.cc:32:7 #1 0x5573fb809994 in autofill_assistant::Starter::Start(std::Cr::unique_ptr<autofill_assistant::TriggerContext, std::Cr::default_delete<autofill_assistant::TriggerContext>>) ./../../components/autofill_assistant/browser/starter.cc:491:44 #2 0x5573fb759f6b in autofill_assistant::HeadlessScriptControllerImpl::StartScript(base::flat_map<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::less<void>, std::Cr::vector<std::Cr::pair<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>>, std::Cr::allocator<std::Cr::pair<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>>>>> const&, base::OnceCallback<void (autofill_assistant::HeadlessScriptController::ScriptResult)>, bool, base::OnceCallback<void ()>, std::Cr::unique_ptr<autofill_assistant::Service, std::Cr::default_delete<autofill_assistant::Service>>, std::Cr::unique_ptr<autofill_assistant::WebController, std::Cr::default_delete<autofill_assistant::WebController>>) ./../../components/autofill_assistant/browser/headless/headless_script_controller_impl.cc:72:13 #3 0x5573d0c23167 in autofill_assistant::HeadlessScriptControllerImplTest::Start(base::flat_map<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::less<void>, std::Cr::vector<std::Cr::pair<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>>, std::Cr::allocator<std::Cr::pair<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>>>>> const&, bool) ./../../components/autofill_assistant/browser/headless/headless_script_controller_impl_unittest.cc:146:34 #4 0x5573d0c23aba in autofill_assistant::HeadlessScriptControllerImplTest_StartFailsIfNoScriptsAvailable_Test::TestBody() ./../../components/autofill_assistant/browser/headless/headless_script_controller_impl_unittest.cc:221:3 #5 0x5573d52eff32 in HandleExceptionsInMethodIfSupported<testing::Test, void> ./../../third_party/googletest/src/googletest/src/gtest-internal-inl.h:0:10 #6 0x5573d52eff32 in testing::Test::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2670:5 #7 0x5573d52f2946 in testing::TestInfo::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2849:11 #8 0x5573d52f4f30 in testing::TestSuite::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:3008:30 #9 0x5573d5323424 in testing::internal::UnitTestImpl::RunAllTests() ./../../third_party/googletest/src/googletest/src/gtest.cc:5866:44 #10 0x5573d5322223 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> ./../../third_party/googletest/src/googletest/src/gtest-internal-inl.h:0:10 #11 0x5573d5322223 in testing::UnitTest::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:5440:10 #12 0x5573e551d8ae in RUN_ALL_TESTS ./../../third_party/googletest/src/googletest/include/gtest/gtest.h:2284:73 #13 0x5573e551d8ae in base::TestSuite::Run() ./../../base/test/test_suite.cc:457:16 #14 0x5573f855e403 in content::UnitTestTestSuite::Run() ./../../content/public/test/unittest_test_suite.cc:187:23 #15 0x5573e284380d in Invoke<int (content::UnitTestTestSuite::*)(), std::Cr::unique_ptr<content::UnitTestTestSuite, std::Cr::default_delete<content::UnitTestTestSuite> > > ./../../base/bind_internal.h:608:12 #16 0x5573e284380d in MakeItSo<int (content::UnitTestTestSuite::*)(), std::Cr::unique_ptr<content::UnitTestTestSuite, std::Cr::default_delete<content::UnitTestTestSuite> > > ./../../base/bind_internal.h:777:12 #17 0x5573e284380d in RunImpl<int (content::UnitTestTestSuite::*)(), std::Cr::tuple<std::Cr::unique_ptr<content::UnitTestTestSuite, std::Cr::default_delete<content::UnitTestTestSuite> > >, 0UL> ./../../base/bind_internal.h:850:12 #18 0x5573e284380d in base::internal::Invoker<base::internal::BindState<int (content::UnitTestTestSuite::*)(), std::Cr::unique_ptr<content::UnitTestTestSuite, std::Cr::default_delete<content::UnitTestTestSuite>>>, int ()>::RunOnce(base::internal::BindStateBase*) ./../../base/bind_internal.h:819:12 #19 0x5573e55292c9 in Run ./../../base/callback.h:145:12 #20 0x5573e55292c9 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::OnceCallback<void ()>) ./../../base/test/launcher/unit_test_launcher.cc:187:38 #21 0x5573e5528d68 in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) ./../../base/test/launcher/unit_test_launcher.cc:278:10 #22 0x5573ceb75f47 in main ./../../components/test/run_all_unittests.cc:8:10 #23 0x7f31ca69783f in __libc_start_main ??:0:0 #24 0x5573c5ca7029 in _start ??:0:0 Uninitialized value was stored to memory at #0 0x5573fb827d81 in autofill_assistant::TriggerContext::TriggerContext(std::Cr::unique_ptr<autofill_assistant::ScriptParameters, std::Cr::default_delete<autofill_assistant::ScriptParameters>>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>> const&, bool, bool, bool, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>> const&, bool, bool, bool) ./../../components/autofill_assistant/browser/trigger_context.cc:59:7 #1 0x5573fb759c20 in make_unique<autofill_assistant::TriggerContext, std::Cr::unique_ptr<autofill_assistant::ScriptParameters, std::Cr::default_delete<autofill_assistant::ScriptParameters> >, const char (&)[1], bool, bool, bool, const char (&)[1], bool, bool, bool> ./../../buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:714:32 #2 0x5573fb759c20 in autofill_assistant::HeadlessScriptControllerImpl::StartScript(base::flat_map<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::less<void>, std::Cr::vector<std::Cr::pair<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>>, std::Cr::allocator<std::Cr::pair<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>>>>> const&, base::OnceCallback<void (autofill_assistant::HeadlessScriptController::ScriptResult)>, bool, base::OnceCallback<void ()>, std::Cr::unique_ptr<autofill_assistant::Service, std::Cr::default_delete<autofill_assistant::Service>>, std::Cr::unique_ptr<autofill_assistant::WebController, std::Cr::default_delete<autofill_assistant::WebController>>) ./../../components/autofill_assistant/browser/headless/headless_script_controller_impl.cc:61:26 #3 0x5573d0c23167 in autofill_assistant::HeadlessScriptControllerImplTest::Start(base::flat_map<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::less<void>, std::Cr::vector<std::Cr::pair<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>>, std::Cr::allocator<std::Cr::pair<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>>>>>> const&, bool) ./../../components/autofill_assistant/browser/headless/headless_script_controller_impl_unittest.cc:146:34 #4 0x5573d0c23aba in autofill_assistant::HeadlessScriptControllerImplTest_StartFailsIfNoScriptsAvailable_Test::TestBody() ./../../components/autofill_assistant/browser/headless/headless_script_controller_impl_unittest.cc:221:3 #5 0x5573d52eff32 in HandleExceptionsInMethodIfSupported<testing::Test, void> ./../../third_party/googletest/src/googletest/src/gtest-internal-inl.h:0:10 #6 0x5573d52eff32 in testing::Test::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2670:5 #7 0x5573d52f2946 in testing::TestInfo::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2849:11 #8 0x5573d52f4f30 in testing::TestSuite::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:3008:30 #9 0x5573d5323424 in testing::internal::UnitTestImpl::RunAllTests() ./../../third_party/googletest/src/googletest/src/gtest.cc:5866:44 #10 0x5573d5322223 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> ./../../third_party/googletest/src/googletest/src/gtest-internal-inl.h:0:10 #11 0x5573d5322223 in testing::UnitTest::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:5440:10 #12 0x5573e551d8ae in RUN_ALL_TESTS ./../../third_party/googletest/src/googletest/include/gtest/gtest.h:2284:73 #13 0x5573e551d8ae in base::TestSuite::Run() ./../../base/test/test_suite.cc:457:16 #14 0x5573f855e403 in content::UnitTestTestSuite::Run() ./../../content/public/test/unittest_test_suite.cc:187:23 #15 0x5573e284380d in Invoke<int (content::UnitTestTestSuite::*)(), std::Cr::unique_ptr<content::UnitTestTestSuite, std::Cr::default_delete<content::UnitTestTestSuite> > > ./../../base/bind_internal.h:608:12 #16 0x5573e284380d in MakeItSo<int (content::UnitTestTestSuite::*)(), std::Cr::unique_ptr<content::UnitTestTestSuite, std::Cr::default_delete<content::UnitTestTestSuite> > > ./../../base/bind_internal.h:777:12 #17 0x5573e284380d in RunImpl<int (content::UnitTestTestSuite::*)(), std::Cr::tuple<std::Cr::unique_ptr<content::UnitTestTestSuite, std::Cr::default_delete<content::UnitTestTestSuite> > >, 0UL> ./../../base/bind_internal.h:850:12 #18 0x5573e284380d in base::internal::Invoker<base::internal::BindState<int (content::UnitTestTestSuite::*)(), std::Cr::unique_ptr<content::UnitTestTestSuite, std::Cr::default_delete<content::UnitTestTestSuite>>>, int ()>::RunOnce(base::internal::BindStateBase*) ./../../base/bind_internal.h:819:12 #19 0x5573e55292c9 in Run ./../../base/callback.h:145:12 #20 0x5573e55292c9 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::OnceCallback<void ()>) ./../../base/test/launcher/unit_test_launcher.cc:187:38 #21 0x5573e5528d68 in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) ./../../base/test/launcher/unit_test_launcher.cc:278:10 #22 0x5573ceb75f47 in main ./../../components/test/run_all_unittests.cc:8:10 #23 0x7f31ca69783f in __libc_start_main ??:0:0 Uninitialized value was created by a heap allocation #0 0x5573c5d23eb9 in operator new(unsigned long) /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/msan/msan_new_delete.cpp:45:35 #1 0x5573d0c34199 in testing::internal::TestFactoryImpl<autofill_assistant::HeadlessScriptControllerImplTest_StartFailsIfNoScriptsAvailable_Test>::CreateTest() headless_script_controller_impl_unittest.cc:0:0 #2 0x5573d52f28d4 in HandleExceptionsInMethodIfSupported<testing::internal::TestFactoryBase, testing::Test *> ./../../third_party/googletest/src/googletest/src/gtest.cc:0:0 #3 0x5573d52f28d4 in testing::TestInfo::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2839:22 #4 0x5573d52f4f30 in testing::TestSuite::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:3008:30 #5 0x5573d5323424 in testing::internal::UnitTestImpl::RunAllTests() ./../../third_party/googletest/src/googletest/src/gtest.cc:5866:44 #6 0x5573d5322223 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> ./../../third_party/googletest/src/googletest/src/gtest-internal-inl.h:0:10 #7 0x5573d5322223 in testing::UnitTest::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:5440:10 #8 0x5573e551d8ae in RUN_ALL_TESTS ./../../third_party/googletest/src/googletest/include/gtest/gtest.h:2284:73 #9 0x5573e551d8ae in base::TestSuite::Run() ./../../base/test/test_suite.cc:457:16 #10 0x5573f855e403 in content::UnitTestTestSuite::Run() ./../../content/public/test/unittest_test_suite.cc:187:23 #11 0x5573e284380d in Invoke<int (content::UnitTestTestSuite::*)(), std::Cr::unique_ptr<content::UnitTestTestSuite, std::Cr::default_delete<content::UnitTestTestSuite> > > ./../../base/bind_internal.h:608:12 #12 0x5573e284380d in MakeItSo<int (content::UnitTestTestSuite::*)(), std::Cr::unique_ptr<content::UnitTestTestSuite, std::Cr::default_delete<content::UnitTestTestSuite> > > ./../../base/bind_internal.h:777:12 #13 0x5573e284380d in RunImpl<int (content::UnitTestTestSuite::*)(), std::Cr::tuple<std::Cr::unique_ptr<content::UnitTestTestSuite, std::Cr::default_delete<content::UnitTestTestSuite> > >, 0UL> ./../../base/bind_internal.h:850:12 #14 0x5573e284380d in base::internal::Invoker<base::internal::BindState<int (content::UnitTestTestSuite::*)(), std::Cr::unique_ptr<content::UnitTestTestSuite, std::Cr::default_delete<content::UnitTestTestSuite>>>, int ()>::RunOnce(base::internal::BindStateBase*) ./../../base/bind_internal.h:819:12 #15 0x5573e55292c9 in Run ./../../base/callback.h:145:12 #16 0x5573e55292c9 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::OnceCallback<void ()>) ./../../base/test/launcher/unit_test_launcher.cc:187:38 #17 0x5573e5528d68 in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) ./../../base/test/launcher/unit_test_launcher.cc:278:10 #18 0x5573ceb75f47 in main ./../../components/test/run_all_unittests.cc:8:10 #19 0x7f31ca69783f in __libc_start_main ??:0:0 SUMMARY: MemorySanitizer: use-of-uninitialized-value (/b/s/w/ir/out/Release/components_unittests+0x3acb00a1) (BuildId: d348568ed374c786) Exiting Original change's description: > Add tests for headless flows > > This CL refactors the headless script controller and client to allow for the necessary injections to be able to test a full headless flow. This CL also includes a couple of basic tests. More coverage will follow. > > > Bug: b/201964911 > Change-Id: I8fc67dbbd064e4b65da7e8a4dcd52c946dc3ca75 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3807499 > Reviewed-by: Clemens Arbesser <arbesser@google.com> > Commit-Queue: Luca Hunkeler <hluca@google.com> > Cr-Commit-Position: refs/heads/main@{#1031959} Bug: b/201964911 Change-Id: Ia5123a7369277f1dad3f952f843f13da85fceedb No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3813793 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Mark Pearson <mpearson@chromium.org> Owners-Override: Mark Pearson <mpearson@chromium.org> Cr-Commit-Position: refs/heads/main@{#1032115}

Using GDB, I found that an underflow occurred with a range = {start_ = 0, end_ = 3} and selection_before=3 and would lead to a selection being constructed like gfx::Range::Range (start=18446744073709551613, end=<optimized out>, this=<optimized out>). This seemed to induce a crash further down the stack. Tested that the test crashes with the old code: ``` [ RUN ] InputMethodAshTest.SetCompositionTextFails Received signal 4 ILL_ILLOPN 556aba022ebf #0 0x556ab9d9d9d2 base::debug::CollectStackTrace() #1 0x556ab9ce5103 base::debug::StackTrace::StackTrace() #2 0x556ab9d9d566 base::debug::(anonymous namespace)::StackDumpSignalHandler() #3 0x7f7123b99200 (/usr/lib/x86_64-linux-gnu/libpthread-2.33.so+0x121ff) #4 0x556aba022ebf ui::InputMethodAsh::SetCompositionRange() #5 0x556ab98c4b3d ui::InputMethodAshTest_SetCompositionTextFails_Test::TestBody() #6 0x556ab99b79f2 testing::Test::Run() #7 0x556ab99b82a0 testing::TestInfo::Run() #8 0x556ab99b8b27 testing::TestSuite::Run() #9 0x556ab99c1c48 testing::internal::UnitTestImpl::RunAllTests() #10 0x556ab99c18a9 testing::UnitTest::Run() #11 0x556ab9def29d base::TestSuite::Run() #12 0x556ab9cbc6cc _ZNO4base12OnceCallbackIFivEE3RunEv #13 0x556ab9df1657 base::LaunchUnitTests() #14 0x556ab988d627 main #15 0x7f712386d7fd __libc_start_main #16 0x556ab97d14ea _start r8: 00007ffdfba1a930 r9: fffffffffffffff8 r10: 00007ffdfba1a5e0 r11: 00007ffdfba1a5d8 r12: 0000000000000005 r13: 0000000000002710 r14: 00007ffdfba1a910 r15: 00007ffdfba1a8a0 di: 00007ffdfba1a8a0 si: 00007ffdfba1a638 bp: 00007ffdfba1a670 bx: 00007ffdfba1a680 dx: 0000000000000000 ax: ffffffffffffd8f0 cx: 00000000ffffffff sp: 00007ffdfba1a630 ip: 0000556aba022ebf efl: 0000000000010a07 cgf: 002b000000000033 erf: 0000000000000000 trp: 0000000000000006 msk: 0000000000000000 cr2: 0000000000000000 [end of stack trace] Calling _exit(EXIT_FAILURE). Core file will not be generated. [731/734] InputMethodAshTest.SetCompositionTextFails (CRASHED) [732/734] InputMethodAshTest.ExtractCompositionTextTest_SingleUnderline (1 ms) [733/734] InputMethodAshTest.ExtractCompositionTextTest_DoubleUnderline (1 ms) [734/734] InputMethodAshTest.ExtractCompositionTextTest_ErrorUnderline (1 ms) 1 test crashed: InputMethodAshTest.SetCompositionTextFails (../../ui/base/ime/ash/input_method_ash_unittest.cc:596) ``` CRBUG=1347801 Change-Id: Ie516bc42fd19e9b2db5e7b1408b4ad3b20c1583e Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3823154 Reviewed-by: Mehrab N <mehrab@chromium.org> Commit-Queue: Keith Lee <keithlee@chromium.org> Reviewed-by: Darren Shen <shend@chromium.org> Auto-Submit: Keith Lee <keithlee@chromium.org> Cr-Commit-Position: refs/heads/main@{#1034343}

This reverts commit 395b2b1. Reason for revert: the following test cases fail - MediaFoundationRendererIntegrationTest.BasicPlayback - MediaFoundationRendererIntegrationTest.BasicPlayback_MediaSource on Windows 10/Asan with the failure log: [ RUN ] MediaFoundationRendererIntegrationTest.BasicPlayback ================================================================= ==644==ERROR: AddressSanitizer: access-violation on unknown address 0x000000000008 (pc 0x7ff6889a1e92 bp 0x00c26c4fe5f0 sp 0x00c26c4fe560 T0) ==644==The signal is caused by a READ memory access. ==644==Hint: address points to the zero page. ==644==*** WARNING: Failed to initialize DbgHelp! *** ==644==*** Most likely this means that the app is already *** ==644==*** using DbgHelp, possibly with incompatible flags. *** ==644==*** Due to technical reasons, symbolization might crash *** ==644==*** or produce wrong results. *** #0 0x7ff6889a1e91 in base::RepeatingCallback<void (const base::UnguessableToken &, const gfx::Size &, base::TimeDelta)>::Run C:\b\s\w\ir\cache\builder\src\base\callback.h:263 #1 0x7ff6889a1e91 in media::MediaFoundationRenderer::RequestNextFrame(void) C:\b\s\w\ir\cache\builder\src\media\renderers\win\media_foundation_renderer.cc:1022:23 #2 0x7ff68899bed8 in media::MediaFoundationRenderer::OnPlaying(void) C:\b\s\w\ir\cache\builder\src\media\renderers\win\media_foundation_renderer.cc:838:3 #3 0x7ff68a04bb3a in base::OnceCallback<void ()>::Run C:\b\s\w\ir\cache\builder\src\base\callback.h:145 #4 0x7ff68a04bb3a in base::TaskAnnotator::RunTaskImpl(struct base::PendingTask &) C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.cc:133:32 #5 0x7ff68ac91059 in base::TaskAnnotator::RunTask C:\b\s\w\ir\cache\builder\src\base\task\common\task_annotator.h:72 #6 0x7ff68ac91059 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(class base::LazyNow *) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:422:21 #7 0x7ff68ac90046 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork(void) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:292:41 #8 0x7ff68acc53da in base::MessagePumpDefault::Run(class base::MessagePump::Delegate *) C:\b\s\w\ir\cache\builder\src\base\message_loop\message_pump_default.cc:39:55 #9 0x7ff68ac9316b in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, class base::TimeDelta) C:\b\s\w\ir\cache\builder\src\base\task\sequence_manager\thread_controller_with_message_pump_impl.cc:575:12 #10 0x7ff68960a00c in base::RunLoop::Run(class base::Location const &) C:\b\s\w\ir\cache\builder\src\base\run_loop.cc:141:14 #11 0x7ff68942c9a7 in media::PipelineIntegrationTestBase::RunUntilQuitOrError(class base::RunLoop *) C:\b\s\w\ir\cache\builder\src\media\test\pipeline_integration_test_base.cc:697:13 #12 0x7ff689424636 in media::PipelineIntegrationTestBase::RunUntilQuitOrEndedOrError(class base::RunLoop *) C:\b\s\w\ir\cache\builder\src\media\test\pipeline_integration_test_base.cc:709:3 #13 0x7ff689424449 in media::PipelineIntegrationTestBase::WaitUntilEndedOrError(void) C:\b\s\w\ir\cache\builder\src\media\test\pipeline_integration_test_base.cc:226:5 #14 0x7ff689423ac4 in media::PipelineIntegrationTestBase::WaitUntilOnEnded(void) C:\b\s\w\ir\cache\builder\src\media\test\pipeline_integration_test_base.cc:217:27 #15 0x7ff686ce4597 in media::MediaFoundationRendererIntegrationTest_BasicPlayback_Test::TestBody(void) C:\b\s\w\ir\cache\builder\src\media\renderers\win\media_foundation_renderer_integration_test.cc:92:3 #16 0x7ff6870b0c77 in testing::Test::Run(void) C:\b\s\w\ir\cache\builder\src\third_party\googletest\src\googletest\src\gtest.cc:2670:5 #17 0x7ff6870b2c3b in testing::TestInfo::Run(void) C:\b\s\w\ir\cache\builder\src\third_party\googletest\src\googletest\src\gtest.cc:2849:11 #18 0x7ff6870b498e in testing::TestSuite::Run(void) C:\b\s\w\ir\cache\builder\src\third_party\googletest\src\googletest\src\gtest.cc:3008:30 #19 0x7ff6870d772f in testing::internal::UnitTestImpl::RunAllTests(void) C:\b\s\w\ir\cache\builder\src\third_party\googletest\src\googletest\src\gtest.cc:5866:44 #20 0x7ff6870d6bd5 in testing::UnitTest::Run(void) C:\b\s\w\ir\cache\builder\src\third_party\googletest\src\googletest\src\gtest.cc:5440:10 #21 0x7ff6896d7a69 in RUN_ALL_TESTS C:\b\s\w\ir\cache\builder\src\third_party\googletest\src\googletest\include\gtest\gtest.h:2284 #22 0x7ff6896d7a69 in base::TestSuite::Run(void) C:\b\s\w\ir\cache\builder\src\base\test\test_suite.cc:463:16 #23 0x7ff6896dc4ed in base::OnceCallback<int ()>::Run C:\b\s\w\ir\cache\builder\src\base\callback.h:145 #24 0x7ff6896dc4ed in base::`anonymous namespace'::LaunchUnitTestsInternal C:\b\s\w\ir\cache\builder\src\base\test\launcher\unit_test_launcher.cc:181:38 #25 0x7ff6896dc0ba in base::LaunchUnitTests(int, char **, class base::OnceCallback<(void)>, unsigned __int64) C:\b\s\w\ir\cache\builder\src\base\test\launcher\unit_test_launcher.cc:272:10 #26 0x7ff686dcc7f9 in main C:\b\s\w\ir\cache\builder\src\media\test\run_all_unittests.cc:52:10 #27 0x7ff68c67712b in invoke_main d:\a01\_work\12\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:78 #28 0x7ff68c67712b in __scrt_common_main_seh d:\a01\_work\12\s\src\vctools\crt\vcstartup\src\startup\exe_common.inl:288 #29 0x7fff384a2773 (C:\Windows\System32\KERNEL32.DLL+0x180012773) #30 0x7fff386e0d50 (C:\Windows\SYSTEM32\ntdll.dll+0x180070d50) AddressSanitizer can not provide additional info. SUMMARY: AddressSanitizer: access-violation C:\b\s\w\ir\cache\builder\src\base\callback.h:263 in base::RepeatingCallback<void (const base::UnguessableToken &, const gfx::Size &, base::TimeDelta)>::Run ==644==ABORTING Original change's description: > [MediaFoundation] Request next frame during onPlaying event > > OS: Win10, Win11 > > During OnPlaying event, a frame request should be called to get > the first frame to output at the earliest possible time. This > is the earliest time when a frame is available. Current > implementation waits for render to be called, while > StartPlayingFrom's call for RequestNextFrameBetweenTimestamps > may not output a result if the media engine is not yet ready > to output a frame. > > Bug: 1355520 > Change-Id: Ice60ac41ca4b8cae9b0687626e93017d0a4406f0 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3852409 > Reviewed-by: Xiaohan Wang <xhwang@chromium.org> > Commit-Queue: Daoyuan Li <daoyuanli@microsoft.com> > Reviewed-by: Daniel Cheng <dcheng@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1041097} Bug: 1355520 Change-Id: Ic483e314ce14e3f187691df772515eacea387cb1 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3863075 Commit-Queue: Asami Doi <asamidoi@chromium.org> Owners-Override: Asami Doi <asamidoi@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Auto-Submit: Asami Doi <asamidoi@chromium.org> Cr-Commit-Position: refs/heads/main@{#1041256}

Enabling ozone_unittests on linux bots revealed some problems with downcasting. In particular, linux-ubsan-vptr bot started to fail with the following error message - ./../ui/ozone/platform/wayland/host/wayland_data_drag_controller.cc:515:10: runtime error: downcast of address 0x2ccc00349e00 which does not point to an object of type 'const WaylandExchangeDataProvider' 0x2ccc00349e00: note: object is of type 'ui::OSExchangeDataProviderNonBacked' 00 00 00 00 28 3b f6 e3 f0 55 00 00 01 00 00 00 00 00 00 00 20 b1 26 00 cc 2c 00 00 28 00 00 00 ^~~~~~~~~~~~~~~~~~~~~~~ vptr for 'ui::OSExchangeDataProviderNonBacked' #0 0x55f0e331831c in GetOfferedExchangeDataProvider ui/ozone/platform/wayland/host/wayland_data_drag_controller.cc:515:10 #1 0x55f0e331831c in ui::WaylandDataDragController::StartSession(ui::OSExchangeData const&, int, ui::mojom::DragEventSource) ui/ozone/platform/wayland/host/wayland_data_drag_controller.cc:133:23 #2 0x55f0e3366bbc in ui::WaylandWindow::StartDrag(ui::OSExchangeData const&, int, ui::mojom::DragEventSource, ui::Cursor, bool, base::OnceCallback<void (ui::mojom::DragOperation)>, ui::WmDragHandler::LocationDelegate*) ui/ozone/platform/wayland/host/wayland_window.cc:227:45 #3 0x55f0e2b28c32 in ui::WaylandDataDragControllerTest_AsyncNoopStartDrag_Test::TestBody() ui/ozone/platform/wayland/host/wayland_data_drag_controller_unittest.cc:973:28 #4 0x55f0e2e26ab1 in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc:2670:5 #5 0x55f0e2e28046 in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2849:11 #6 0x55f0e2e29beb in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3008:30 #7 0x55f0e2e3fafe in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:5866:44 #8 0x55f0e2e3e604 in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc:5440:10 #9 0x55f0e34276d1 in RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2284:73 #10 0x55f0e34276d1 in base::TestSuite::Run() base/test/test_suite.cc:463:16 #11 0x55f0e342b9dc in Run base/callback.h:145:12 #12 0x55f0e342b9dc in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) base/test/launcher/unit_test_launcher.cc:181:38 #13 0x55f0e342b877 in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) base/test/launcher/unit_test_launcher.cc:272:10 #14 0x55f0e2acc2cc in main mojo/core/test/run_all_unittests.cc:69:10 #15 0x7ff7560d4082 in __libc_start_main /build/glibc-SzIz7B/glibc-2.31/csu/../csu/libc-start.c:308:16 #16 0x55f0e2ab4169 in _start (/home/msisov/code/chromium/src/out/asan/ozone_unittests+0xb13169) (BuildId: 77bfee5b71bd92da) It turned out that WaylandDataDragController was getting a non-backed provider as a Wayland one wasn't set (it's set during OzonePlatformWayland initialization in production). As a result, downcasting to WaylandExchangeDataProvider was illegal in tests. It's unknown why tests didn't fail. Probably, the result of the WaylandDataDragController::GetOfferedExchangeDataProvider was never used. And the problem with downcasting was only caught with this new bot. Bug: 1358123 Change-Id: I4c8deb16a57b485de1fabd91fdcaab136d5da639 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3865512 Commit-Queue: Maksim Sisov <msisov@igalia.com> Reviewed-by: Alexander Dunaev <adunaev@igalia.com> Cr-Commit-Position: refs/heads/main@{#1041976}

`char16_t` (which `UChar` is defined as) cannot be used to alias general memory. Yet we try to use it to read a `blink::QualifiedName::QualifiedNameImpl` among other things. This is UB, and gcc -O2 misoptimizes it. When chromium is compiled with allocator shim, this manifests as an immediate crash: * frame #0: 0x0000556e1280927b electron`FreelistCorruptionDetected [inlined] operator() at partition_freelist_entry.h:31 frame #1: 0x0000556e1280927a electron`FreelistCorruptionDetected(extra=48) at partition_freelist_entry.h:31 frame #2: 0x0000556e129dd167 electron`partition_alloc::internal::PartitionBucket<true>::SlowPathAlloc(partition_alloc::PartitionRoot<true>*, unsigned int, unsigned long, unsigned long, bool*) at partition_freelist_entry.h:303 frame #3: 0x0000556e129dd162 electron`partition_alloc::internal::PartitionBucket<true>::SlowPathAlloc(partition_alloc::PartitionRoot<true>*, unsigned int, unsigned long, unsigned long, bool*) [inlined] partition_alloc::internal::PartitionFreelistEntry::GetNext(unsigned long) const at partition_freelist_entry.h:328 frame #4: 0x0000556e129dd162 electron`partition_alloc::internal::PartitionBucket<true>::SlowPathAlloc(partition_alloc::PartitionRoot<true>*, unsigned int, unsigned long, unsigned long, bool*) [inlined] partition_alloc::internal::SlotSpanMetadata<true>::PopForAlloc(unsigned long) at partition_page.h:739 frame #5: 0x0000556e129dd162 electron`partition_alloc::internal::PartitionBucket<true>::SlowPathAlloc(this=0x0000556e19292598, root=0x0000556e19292500, flags=33, raw_size=<unavailable>, slot_span_alignment=48, is_already_zeroed=0x00007ffe8f1196f7) at partition_bucket.cc:1354 frame #6: 0x0000556e129ddbc0 electron`partition_alloc::ThreadCache::FillBucket(unsigned long) at partition_root.h:1076 frame #7: 0x0000556e129ddbbb electron`partition_alloc::ThreadCache::FillBucket(this=<unavailable>, bucket_index=5755259732000) at thread_cache.cc:607 frame #8: 0x0000556e129dfd3a electron`base::internal::PartitionMalloc(base::allocator::AllocatorDispatch const*, unsigned long, void*) at thread_cache.h:525 frame #9: 0x0000556e129dfd18 electron`base::internal::PartitionMalloc(base::allocator::AllocatorDispatch const*, unsigned long, void*) at partition_root.h:1742 frame #10: 0x0000556e129dfb18 electron`base::internal::PartitionMalloc((null)=<unavailable>, size=40, context=<unavailable>) at allocator_shim_default_dispatch_to_partition_alloc.cc:304 frame #11: 0x0000556e128dbe43 electron`::malloc(unsigned long) at allocator_shim.cc:201:37 frame #12: 0x0000556e128dbe30 electron`::malloc(size=40) at allocator_shim_override_libc_symbols.h:35:20 frame #13: 0x0000556e16c0f6e6 electron`WTF::HashTableAddResult<WTF::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, WTF::IdentityExtractor, blink::QualifiedNameHash, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::PartitionAllocator>, blink::QualifiedName::QualifiedNameImpl*> WTF::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, WTF::IdentityExtractor, blink::QualifiedNameHash, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::PartitionAllocator>::InsertPassingHashCode<WTF::HashSetTranslatorAdapter<blink::QNameComponentsTranslator>, blink::QualifiedNameData&, blink::QualifiedNameData&>(blink::QualifiedNameData&, blink::QualifiedNameData&) (.constprop.0) [inlined] WTF::RefCounted<blink::QualifiedName::QualifiedNameImpl, WTF::DefaultRefCountedTraits<blink::QualifiedName::QualifiedNameImpl>>::operator new(unsigned long) at ref_counted.h:44 frame #14: 0x0000556e16c0f6e1 electron`WTF::HashTableAddResult<WTF::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, WTF::IdentityExtractor, blink::QualifiedNameHash, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::PartitionAllocator>, blink::QualifiedName::QualifiedNameImpl*> WTF::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, WTF::IdentityExtractor, blink::QualifiedNameHash, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::PartitionAllocator>::InsertPassingHashCode<WTF::HashSetTranslatorAdapter<blink::QNameComponentsTranslator>, blink::QualifiedNameData&, blink::QualifiedNameData&>(blink::QualifiedNameData&, blink::QualifiedNameData&) (.constprop.0) [inlined] blink::QualifiedName::QualifiedNameImpl::Create((null)=<unavailable>, (null)=<unavailable>, (null)=<unavailable>, (null)=<unavailable>) at qualified_name.h:62 frame #15: 0x0000556e16c0f6dd electron`WTF::HashTableAddResult<WTF::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, WTF::IdentityExtractor, blink::QualifiedNameHash, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::PartitionAllocator>, blink::QualifiedName::QualifiedNameImpl*> WTF::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, WTF::IdentityExtractor, blink::QualifiedNameHash, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::PartitionAllocator>::InsertPassingHashCode<WTF::HashSetTranslatorAdapter<blink::QNameComponentsTranslator>, blink::QualifiedNameData&, blink::QualifiedNameData&>(blink::QualifiedNameData&, blink::QualifiedNameData&) (.constprop.0) at qualified_name.cc:69 frame #16: 0x0000556e16c0f6ba electron`WTF::HashTableAddResult<WTF::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, WTF::IdentityExtractor, blink::QualifiedNameHash, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::PartitionAllocator>, blink::QualifiedName::QualifiedNameImpl*> WTF::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, WTF::IdentityExtractor, blink::QualifiedNameHash, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::PartitionAllocator>::InsertPassingHashCode<WTF::HashSetTranslatorAdapter<blink::QNameComponentsTranslator>, blink::QualifiedNameData&, blink::QualifiedNameData&>(blink::QualifiedNameData&, blink::QualifiedNameData&) (.constprop.0) [inlined] void WTF::HashSetTranslatorAdapter<blink::QNameComponentsTranslator>::Translate<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedNameData&, blink::QualifiedNameData>(blink::QualifiedName::QualifiedNameImpl*&, blink::QualifiedNameData&, blink::QualifiedNameData const&, unsigned int) at hash_set.h:184 frame #17: 0x0000556e16c0f6ba electron`WTF::HashTableAddResult<WTF::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, WTF::IdentityExtractor, blink::QualifiedNameHash, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::PartitionAllocator>, blink::QualifiedName::QualifiedNameImpl*> WTF::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, WTF::IdentityExtractor, blink::QualifiedNameHash, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::PartitionAllocator>::InsertPassingHashCode<WTF::HashSetTranslatorAdapter<blink::QNameComponentsTranslator>, blink::QualifiedNameData&, blink::QualifiedNameData&>((null)=<unavailable>, (null)=<unavailable>, (null)=<unavailable>) (.constprop.0) at hash_table.h:1481 frame #18: 0x0000556e1492f9cf electron`blink::QualifiedName::QualifiedName(WTF::AtomicString const&, WTF::AtomicString const&, WTF::AtomicString const&) [inlined] WTF::HashTableAddResult<WTF::HashTable<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedName::QualifiedNameImpl*, WTF::IdentityExtractor, blink::QualifiedNameHash, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::PartitionAllocator>, blink::QualifiedName::QualifiedNameImpl*> WTF::HashSet<blink::QualifiedName::QualifiedNameImpl*, blink::QualifiedNameHash, WTF::HashTraits<blink::QualifiedName::QualifiedNameImpl*>, WTF::PartitionAllocator>::AddWithTranslator<blink::QNameComponentsTranslator, blink::QualifiedNameData&>(blink::QualifiedNameData&) at hash_set.h:307 frame #19: 0x0000556e1492f9ca electron`blink::QualifiedName::QualifiedName((null)=<unavailable>, (null)=<unavailable>, (null)=<unavailable>, (null)=<unavailable>) at qualified_name.cc:81 When chromium is compiled with system malloc, this manifests as graphical glitches, followed by a crash much later on. It is worth noting that this exact code snippet was discussed on the GCC bugtracker in 2014 (predating the forking of Chromium from WebKit): https://gcc.gnu.org/bugzilla/show_bug.cgi?id=60546#c21 The corresponding code no longer exists in WebKit. Attached patch makes the HashMemory function type-safe without changing the API for other users of StringHasher. Bug: 819294 Change-Id: Iac11ec77501c2f1d6d01db85d5b9d544adeaf71d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3968507 Reviewed-by: Kentaro Hara <haraken@chromium.org> Commit-Queue: Kentaro Hara <haraken@chromium.org> Auto-Submit: Bruno Pitrus <brunopitrus@hotmail.com> Cr-Commit-Position: refs/heads/main@{#1061939}

In View::HandleAccessibleAction, accessibility sends both a press and release mouse event to the view instance. Unfortunately, if the view deletes itself immediately after receiving the mouse press event, the subsequent mouse release event causes a UAF. e.g. for illustrative purposes, here's the flow: bool HandleAccessibleAction(...) { view->OnEvent(mouse_press); // |view| is now deleted. view->OnEvent(mouse_release); // UAF. } Fix this by overriding HandleAccessibleAction in the self-deleting view. Notes: The deletion stack for the WindowCycleItemView is #3 0x560338183db8 in operator() buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:49:5 #4 0x560338183db8 in reset buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:281:7 #5 0x560338183db8 in ~unique_ptr buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:247:75 #6 0x560338183db8 in views::View::DoRemoveChildView(views::View*, bool, bool, views::View*) ui/views/view.cc:2739:1 #7 0x560338183fe4 in views::View::RemoveAllChildViews() ui/views/view.cc:341:5 #8 0x560333f50cbb in ash::WindowCycleView::DestroyContents() ash/wm/window_cycle/window_cycle_view.cc:379:3 #9 0x560333f4b3e7 in ash::WindowCycleList::~WindowCycleList() ash/wm/window_cycle/window_cycle_list.cc:139:18 #10 0x560333f4b747 in ash::WindowCycleList::~WindowCycleList() ash/wm/window_cycle/window_cycle_list.cc:117:37 #11 0x560333f475e8 in operator() buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:49:5 #12 0x560333f475e8 in reset buildtools/third_party/libc++/trunk/include/__memory/unique_ptr.h:281:7 #13 0x560333f475e8 in ash::WindowCycleController::StopCycling() ash/wm/window_cycle/window_cycle_controller.cc:421:22 #14 0x560333f5944c in ash::WindowCycleItemView::OnMousePressed(ui::MouseEvent const&) ash/wm/window_cycle/window_cycle_item_view.cc:53:44 #15 0x560338193ae2 in views::View::ProcessMousePressed(ui::MouseEvent const&) ui/views/view.cc:3109:23 #16 0x56033819362d in views::View::OnMouseEvent(ui::MouseEvent*) ui/views/view.cc:1492:11 Bug: 1380602 Change-Id: I2533dc299c0f5f5bb32efa130e6d564cb70d4613 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4046647 Commit-Queue: David Tseng <dtseng@chromium.org> Reviewed-by: Xiaoqian Dai <xdai@chromium.org> Cr-Commit-Position: refs/heads/main@{#1076637}

During an ongoing tab dragging on Lacros, with both WebUITabStrip and TabletMode features ON, Lacros crashes in case the dragged `exo::ShellSurface` (ie browser window) is deleted by JavaScript. What happens is that during a tab drag 'n drop, exo::TabDragDropDelegate store an `aura::Window` instance, and operates over it throughout its life cycle. However, during the drag operation, it is possible that this `aura::Window` instance gets deleted, and the pointer becomes dangling. Here is the pseudo stacktrace of the dragged `aura::Window` instance (and its respective exo::ShellSurface) being destroyed: #4 ~Window () at ../../ui/aura/window.cc:201 #5 aura::Window::~Window() () at ../../ui/aura/window.cc:186 #6 CloseNow () at ../../ui/views/widget/widget.cc:787 #7 ~ShellSurfaceBase () at ../../components/exo/shell_surface_base.cc:347 #8 ~ShellSurface () at ../../components/exo/shell_surface.cc:140 #9 ~XdgShellSurface () at ../../components/exo/xdg_shell_surface.cc:27 #10 ~XdgShellSurface () at ../../components/exo/xdg_shell_surface.cc:27 #11 operator() () at (...) #12 reset () at (...) #13 ~unique_ptr () at (...) #14 ~WaylandXdgSurface () at ../../components/exo/wayland/xdg_shell.cc:783 #15 operator() () at (...) #16 reset () at (...) #17 ~unique_ptr () at (...) #18 DestroyUserData<exo::wayland::WaylandXdgSurface> () at ../../components/exo/wayland/server_util.h:40 #19 0x0000556095b8ae10 in destroy_resource () at ../../third_party/wayland/src/src/wayland-server.c:733 #20 0x0000556095b8acb0 in wl_resource_destroy () at ../../third_party/wayland/src/src/wayland-server.c:750 #21 0x00005560a6dc1d65 in ffi_call_unix64 () #22 0x00005560a6dc12b9 in ffi_call_int () ... and here is the stack trace of the crash, where this `aura::Window` is dereferenced: #0 is_destroying ui/aura/window.h:166:39 #1 ash::TabDragDropDelegate::~TabDragDropDelegate() ash/drag_drop/tab_drag_drop_delegate.cc:117:23 #2 ash::TabDragDropDelegate::~TabDragDropDelegate() ash/drag_drop/tab_drag_drop_delegate.cc:114:45 #3 operator() (...) #4 reset (...) #5 ash::DragDropController::Cleanup() ash/drag_drop/drag_drop_controller.cc:800:27 #6 ash::DragDropController::DoDragCancel(base::TimeDelta) ash/drag_drop/drag_drop_controller.cc:702:3 #7 exo::DragDropOperation::~DragDropOperation() components/exo/drag_drop_operation.cc:277:28 #8 exo::DragDropOperation::~DragDropOperation() components/exo/drag_drop_operation.cc:270:41 #9 exo::Surface::~Surface() components/exo/surface.cc:286:14 #10 operator() (...) #11 reset (...) #12 ~unique_ptr (...) This CL protects `exo::TabDragDropDelegate` dtor against this crash by making use of `aura::WindowObserver` logic and null-checking `TabDragDropDelegate::source_window_`. Last, this CL also extends exo::ExoTestBase class with an additional SetUp() method, that takes a TestShellDelegate as parameter. BUG=1348791 Change-Id: Ic00886fda66d4150ce07d74d6aaccf31e77bc80b Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4174397 Reviewed-by: Mitsuru Oshima <oshima@chromium.org> Commit-Queue: Antonio Gomes <tonikitoo@igalia.com> Cr-Commit-Position: refs/heads/main@{#1094249}

This reverts commit c262371. Reason for revert: The changes in this CL trigger a DCHECK when running Chrome. See below for callstack and the command I used to build Chrome. Callstack: 2023-02-17T20:24:19.978808Z FATAL chrome[1213141:1213233]: [feature_list.cc(671)] Check failed: CheckFeatureIdentity(feature). GaiaCredentialsModeOmitBug_775438_Workaround #0 0x7f7c3d2a77f2 base::debug::CollectStackTrace() #1 0x7f7c3d289e03 base::debug::StackTrace::StackTrace() #2 0x7f7c3d1654f0 logging::LogMessage::~LogMessage() #3 0x7f7c3d165fce logging::LogMessage::~LogMessage() #4 0x7f7c3d154849 base::FeatureList::GetOverrideState() #5 0x7f7c3d15337d base::FeatureList::IsEnabled() #6 0x7f7c34ed2797 google_apis::GetOmitCredentialsModeForGaiaRequests() #7 0x7f7c34ec0e69 gcm::RegistrationRequest::Start() #8 0x562a357cded1 gcm::GCMClientImpl::Register() #9 0x562a357d5f23 gcm::GCMDriverDesktop::IOWorker::Register() #10 0x7f7c3d1daf5a base::TaskAnnotator::RunTaskImpl() #11 0x7f7c3d2051f8 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl() #12 0x7f7c3d204633 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() #13 0x7f7c3d205d15 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() #14 0x7f7c3d2b34e3 base::MessagePumpEpoll::Run() #15 0x7f7c3d206232 base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run() #16 0x7f7c3d1ab82a base::RunLoop::Run() #17 0x7f7c3d239687 base::Thread::Run() #18 0x7f7c36876359 content::BrowserProcessIOThread::IOThreadRun() #19 0x7f7c368762ec content::BrowserProcessIOThread::Run() #20 0x7f7c3d2399eb base::Thread::ThreadMain() #21 0x7f7c3d25810b base::(anonymous namespace)::ThreadFunc() #22 0x7f7c29aa7fd4 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x88fd3) #23 0x7f7c29b2866c (/usr/lib/x86_64-linux-gnu/libc.so.6+0x10966b) The specific command I used to build Chrome: ``` cd ~/chromium/src; autoninja -C \${out_dir} \ chrome && \${out_dir}/chrome \ --user-data-dir=~/.config/cros \ --use-system-clipboard \ --ash-host-window-bounds="40+40-1920x1080" \ --enable-logging=stderr \ --enable-features=ShimlessRMAFlow,OsFeedback,ShortcutCustomizationApp,ShortcutCustomization,EnableInputInDiagnosticsApp,SearchInShortcutsApp ``` Original change's description: > Use uncredentialed requests to Gaia > > Adopting kOmitBug_775438_Workaround makes the browser spec-compliant and > avoids that developers need to use workarounds such as > --ignore-urlfetcher-cert-requests in order to communicate with non-prod > server environments. > > The change is guarded with a kill switch but is otherwise enabled by > default. > > Below a summary extracted from devidben@'s nice explanation of what this > patch does (readers may find the full Gerrit comment thread > interesting): > > The concrete behavior change is around client certs. Client certs work as follows: > > 1. Either the origin server (depends on what URL you're connecting to) > or the proxy server (depends on the user's network config) can, in a TLS > connection request client certs. > > 2. If we already have a client cert decision recorded for that server, we just use it. > > 3. Otherwise, we show a prompt to the user. > > 4. If the request isn't associated with some tab, we have no place to > show the prompt and we just abort the request. (We cannot continue > without a certificate because that'll persist the "send no certificate" > decision in the net stack... this auth mechanism is somewhat unavoidably > sticky.) > > This CL will change the behavior for just origin-requested client certs (not proxy-requested) to, instead of steps (2-4), unconditionally continue the request with no client certificate. > > Change-Id: I34908fa81c1688ebaf7feb801408d9080207453c > Fixed: 1221565 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4255589 > Reviewed-by: Maks Orlovich <morlovich@chromium.org> > Commit-Queue: Mikel Astiz <mastiz@chromium.org> > Reviewed-by: Rohit Rao <rohitrao@chromium.org> > Reviewed-by: Alex Ilin <alexilin@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1106846} Change-Id: Ib67b7801b007b8bf56a3f65fb0677b94c4719ab9 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4265133 Owners-Override: David Baron <dbaron@chromium.org> Reviewed-by: Maks Orlovich <morlovich@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Reviewed-by: Mikel Astiz <mastiz@chromium.org> Commit-Queue: David Baron <dbaron@chromium.org> Cr-Commit-Position: refs/heads/main@{#1106998}

…ew." This reverts commit 508aa18. Reason for revert: Causes IbanBubbleViewFullFormBrowserTest.Local_ClickingHideOrShowIbanValueManageView failurees. from https://ci.chromium.org/ui/p/chromium/builders/ci/linux-ubsan-vptr/21221/test-results?sortby=&groupby=&q=ExactID%3Aninja%3A%2F%2Fchrome%2Ftest%3Ainteractive_ui_tests%2FIbanBubbleViewFullFormBrowserTest.Local_ClickingHideOrShowIbanValueManageView+VHash%3Ad2ca29b55d68a4ff: ../../chrome/browser/ui/views/autofill/payments/iban_bubble_view_uitest.cc:282:12: runtime error: downcast of address 0x0798015a1b00 which does not point to an object of type 'SaveIbanBubbleView' 0x0798015a1b00: note: object is of type 'autofill::ManageSavedIbanBubbleView' 29 00 00 00 38 f3 68 e6 e4 55 00 00 78 f3 68 e6 e4 55 00 00 c0 ce 6c 01 98 07 00 00 80 18 0b 00 ^~~~~~~~~~~~~~~~~~~~~~~ vptr for 'autofill::ManageSavedIbanBubbleView' #0 0x55e4d02f0701 in autofill::IbanBubbleViewFullFormBrowserTest::GetSaveIbanBubbleView() chrome/browser/ui/views/autofill/payments/iban_bubble_view_uitest.cc:282:12 #1 0x55e4d02fb74f in autofill::IbanBubbleViewFullFormBrowserTest::ClickOnDialogView(views::View*) chrome/browser/ui/views/autofill/payments/iban_bubble_view_uitest.cc:345:5 #2 0x55e4d02f6e6e in autofill::IbanBubbleViewFullFormBrowserTest_Local_ClickingHideOrShowIbanValueManageView_Test::RunTestOnMainThread() chrome/browser/ui/views/autofill/payments/iban_bubble_view_uitest.cc:623:3 #3 0x55e4d99bf48e in content::BrowserTestBase::ProxyRunTestOnMainThreadLoop() content/public/test/browser_test_base.cc:895:7 #4 0x55e4d4a7be0d in Run base/functional/callback.h:152:12 #5 0x55e4d4a7be0d in content::BrowserMainLoop::InterceptMainMessageLoopRun() content/browser/browser_main_loop.cc:1038:36 #6 0x55e4d4a7bf1e in content::BrowserMainLoop::RunMainMessageLoop() content/browser/browser_main_loop.cc:1050:7 #7 0x55e4d4a811f9 in content::BrowserMainRunnerImpl::Run() content/browser/browser_main_runner_impl.cc:158:15 #8 0x55e4d4a75a6d in content::BrowserMain(content::MainFunctionParams) content/browser/browser_main.cc:32:28 #9 0x55e4d6fe2fbe in content::RunBrowserProcessMain(content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:716:10 #10 0x55e4d6fe5438 in content::ContentMainRunnerImpl::RunBrowser(content::MainFunctionParams, bool) content/app/content_main_runner_impl.cc:1276:10 #11 0x55e4d6fe4f4d in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1130:12 #12 0x55e4d6fe02ab in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:324:36 #13 0x55e4d6fe0935 in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:341:10 #14 0x55e4d99be269 in content::BrowserTestBase::SetUp() content/public/test/browser_test_base.cc:575:3 #15 0x55e4d7cec8e0 in InProcessBrowserTest::SetUp() chrome/test/base/in_process_browser_test.cc:484:20 #16 0x55e4d0875e53 in SyncTest::SetUp() chrome/browser/sync/test/integration/sync_test.cc:300:24 #17 0x55e4d0e00c17 in testing::Test::Run() third_party/googletest/src/googletest/src/gtest.cc:2665:3 #18 0x55e4d0e0265e in testing::TestInfo::Run() third_party/googletest/src/googletest/src/gtest.cc:2849:11 #19 0x55e4d0e042fb in testing::TestSuite::Run() third_party/googletest/src/googletest/src/gtest.cc:3008:30 #20 0x55e4d0e1a210 in testing::internal::UnitTestImpl::RunAllTests() third_party/googletest/src/googletest/src/gtest.cc:5866:44 #21 0x55e4d0e18dc8 in testing::UnitTest::Run() third_party/googletest/src/googletest/src/gtest.cc:5440:10 #22 0x55e4daaaa4a0 in RUN_ALL_TESTS third_party/googletest/src/googletest/include/gtest/gtest.h:2284:73 #23 0x55e4daaaa4a0 in base::TestSuite::Run() base/test/test_suite.cc:454:16 #24 0x55e4d7cb6b48 in ChromeTestSuiteRunner::RunTestSuiteInternal(ChromeTestSuite*) chrome/test/base/chrome_test_launcher.cc:95:22 #25 0x55e4d03f6416 in InteractiveUITestSuiteRunner::RunTestSuite(int, char**) chrome/test/base/interactive_ui_tests_main.cc:134:12 #26 0x55e4d99fb844 in content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:415:31 #27 0x55e4d7cb722e in LaunchChromeTests(unsigned long, content::TestLauncherDelegate*, int, char**) chrome/test/base/chrome_test_launcher.cc:318:10 #28 0x55e4d03f63a1 in main chrome/test/base/interactive_ui_tests_main.cc:176:10 #29 0x7fbe2824bc86 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21c86) (BuildId: f7307432a8b162377e77a182b6cc2e53d771ec4b) #30 0x55e4cff4a029 in _start (/b/s/w/ir/out/Release/interactive_ui_tests+0xc8b2029) (BuildId: b65d070fe6c272ab) also: https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20CFI/24652/test-results?sortby=&groupby=&q=ExactID%3Aninja%3A%2F%2Fchrome%2Ftest%3Ainteractive_ui_tests%2FIbanBubbleViewFullFormBrowserTest.Local_ClickingHideOrShowIbanValueManageView+VHash%3A18b587341aed5390 Original change's description: > [IBAN local save] Add eye icon to manage saved IBAN bubble view. > > This CL introduce Eye Icon to manage saved IBAN bubble view, which can > reveal full IBAN value or show masked IBAN on clicking. > > Screenshot: > https://screenshot.googleplex.com/3rtMkB6f6UhSL47 > > Mock: > https://screenshot.googleplex.com/FkAmHC4aPtzt44d > > Bug: 1349109 > Change-Id: I51afa60384ff1065785e8351f355eaa66c76fdd8 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4237378 > Reviewed-by: Peter Kasting <pkasting@chromium.org> > Commit-Queue: Qihui Zhao <qihuizhao@google.com> > Reviewed-by: Vinny Persky <vinnypersky@google.com> > Cr-Commit-Position: refs/heads/main@{#1109451} Bug: 1349109 Change-Id: I473c317aaf5d70e538e6ced970ecc4294491d069 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4291366 Commit-Queue: Brian Begnoche <bcb@chromium.org> Owners-Override: Brian Begnoche <bcb@chromium.org> Auto-Submit: Brian Begnoche <bcb@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#1109581}

This reverts commit 3db66e4. Reason for revert: introduced quite a lot of test failures After this change, quite a lot of tests are failing like this when run in parallel: Received signal 11 SEGV_MAPERR 000000000010 #0 0x5586cfbb1362 base::debug::CollectStackTrace() #1 0x5586cfb97043 base::debug::StackTrace::StackTrace() #2 0x5586cfbb0e5b base::debug::(anonymous namespace)::StackDumpSignalHandler() #3 0x7f7b6f64a980 (/lib/x86_64-linux-gnu/libpthread-2.27.so+0x1297f) #4 0x5586d30583af ash::(anonymous namespace)::GetDefaultTopRowAreFKeysValue() #5 0x5586d3057d62 ash::(anonymous namespace)::GetDefaultKeyboardSettings() #6 0x5586d3057702 ash::KeyboardPrefHandlerImpl::InitializeKeyboardSettings() #7 0x5586d303eb8d ash::InputDeviceSettingsControllerImpl::OnKeyboardListUpdated() #8 0x5586d30481db base::internal::FunctorTraits<>::Invoke<>() #9 0x5586d30480b4 base::internal::Invoker<>::Run() #10 0x5586d3050506 _ZNKR4base17RepeatingCallbackIFvNSt2Cr6vectorIN2ui11InputDeviceENS1_9allocatorIS4_EEEENS2_IjNS5_IjEEEEEE3RunES7_S9_ #11 0x5586d3050360 ash::InputDeviceNotifier<>::RefreshDevices() #12 0x5586d30500e1 ash::InputDeviceNotifier<>::InputDeviceNotifier() #13 0x5586d303e3fe ash::InputDeviceSettingsControllerImpl::Init() #14 0x5586d303e080 ash::InputDeviceSettingsControllerImpl::InputDeviceSettingsControllerImpl() #15 0x5586d2f83b5d ash::Shell::Init() #16 0x5586d2f83167 ash::Shell::CreateInstance() #17 0x5586cf57ea8a ash::AshTestHelper::SetUp() #18 0x5586cf57e769 ash::AshTestHelper::SetUp() #19 0x5586ce66768e BrowserWithTestWindowTest::SetUp() #20 0x5586c8e0f37c testing::Test::Run() and then passing on retry. See https://chromium-swarm.appspot.com/task?id=6148891f87a85710&w=true Also reverting for the dependency for reverting https://chromium-review.googlesource.com/c/chromium/src/+/4375455 for crbug.com/1429313. Original change's description: > Settings Split: Implement keyboard policies in pref handler > > Bug: b/241965700 > Change-Id: I5579395a53df6054e3a23bba3086e3b543aecc0c > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4367666 > Reviewed-by: Michael Checo <michaelcheco@google.com> > Commit-Queue: David Padlipsky <dpad@google.com> > Cr-Commit-Position: refs/heads/main@{#1123980} Bug: b/241965700, 1429313 Change-Id: Id48919b445d28ce808d7f7c18c822338e31e2c42 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4384674 Commit-Queue: Hiroshige Hayashizaki <hiroshige@chromium.org> Owners-Override: Hiroshige Hayashizaki <hiroshige@chromium.org> Reviewed-by: Collin Baker <collinbaker@google.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#1124303}

This reverts commit 135cdf4. Reason for revert: Reverted on suspiscion of breaking tests: https://chromium-review.googlesource.com/c/chromium/src/+/4404274 error AssistantManagerServiceImplTest.ShouldNotCrashRunningAfterStopped history | source | ID: ninja://chromeos:chromeos_unittests/AssistantManagerServiceImplTest.ShouldNotCrashRunningAfterStopped | builder Linux Chromium OS ASan LSan Tests (1) test_suite chromeos_unittests os Ubuntu-18.04 expand_more 30s run #1 unexpectedly failed in task: 616d82542ed81511 expand_more Failure Reason (similar failures): expect_utils.h(49): Failed RunLoop::Run() timed out. Timeout set at TaskEnvironment@base/test/task_environment.cc:415. {"active_queues":[{"any_thread_.immediate_incoming_queuecapacity":14,"any_thread_.immediate_incoming_queuesize":0,"delay_to_next_task_ms":0.591,"delayed_incoming_queue":[{"delayed_run_time":2274764.284,"delayed_run_time_milliseconds_from_now":0.723,"is_cancelled":false,"is_high_res":false,"nestable":true,"posted_from":"CheckResult@chromeos/ash/components/assistant/test_support/expect_utils.h:30","sequence_num":5858}],"delayed_incoming_queue_size":1,"delayed_work_queue":[],"delayed_work_queue_capacity":4,"delayed_work_queue_size":0,"enabled":true,"immediate_incoming_queue":[],"immediate_work_queue":[],"immediate_work_queue_capacity":14,"immediate_work_queue_size":0,"name":"TASK_ENVIRONMENT_DEFAULT_TQ","priority":0,"task_queue_id":"0x616000007880"}],"non_waking_wake_up_queue":{"name":"NonWakingWakeUpQueue","registered_delay_count":0},"queues_to_delete":[],"queues_to_gracefully_shutdown":[],"... expand_more Summary: [ RUN ] AssistantManagerServiceImplTest.ShouldNotCrashRunningAfterStopped chromeos/ash/components/assistant/test_support/expect_utils.h:49: Failure Failed RunLoop::Run() timed out. Timeout set at TaskEnvironment@base/test/task_environment.cc:415. {"active_queues":[{"any_thread_.immediate_incoming_queuecapacity":14,"any_thread_.immediate_incoming_queuesize":0,"delay_to_next_task_ms":0.591,"delayed_incoming_queue":[{"delayed_run_time":2274764.284,"delayed_run_time_milliseconds_from_now":0.723,"is_cancelled":false,"is_high_res":false,"nestable":true,"posted_from":"CheckResult@chromeos/ash/components/assistant/test_support/expect_utils.h:30","sequence_num":5858}],"delayed_incoming_queue_size":1,"delayed_work_queue":[],"delayed_work_queue_capacity":4,"delayed_work_queue_size":0,"enabled":true,"immediate_incoming_queue":[],"immediate_work_queue":[],"immediate_work_queue_capacity":14,"immediate_work_queue_size":0,"name":"TASK_ENVIRONMENT_DEFAULT_TQ","priority":0,"task_queue_id":"0x616000007880"}],"non_waking_wake_up_queue":{"name":"NonWakingWakeUpQueue","registered_delay_count":0},"queues_to_delete":[],"queues_to_gracefully_shutdown":[],"selector":{"immediate_starvation_count":0},"time_domain":{},"wake_up_queue":{"name":"DefaultWakeUpQueue","next_delay_ms":0.723,"registered_delay_count":1}} Stack trace: #0 0x558c875ee996 in operator() ./../../base/test/scoped_run_loop_timeout.cc:54:11 #1 0x558c875ee996 in Invoke<const (lambda at ../../base/test/scoped_run_loop_timeout.cc:51:9) &, const base::Location &, const base::RepeatingCallback<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char> > ()> &, const base::Location &> ./../../base/functional/bind_internal.h:621:12 #2 0x558c875ee996 in MakeItSo<const (lambda at ../../base/test/scoped_run_loop_timeout.cc:51:9) &, const std::Cr::tuple<base::Location, base::RepeatingCallback<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char> > ()> > &, const base::Location &> ./../../base/functional/bind_internal.h:925:12 #3 0x558c875ee996 in RunImpl<const (lambda at ../../base/test/scoped_run_loop_timeout.cc:51:9) &, const std::Cr::tuple<base::Location, base::RepeatingCallback<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char> > ()> > &, 0UL, 1UL> ./../../base/functional/bind_internal.h:1025:12 #4 0x558c875ee996 in base::internal::Invoker<base::internal::BindState<base::test::ScopedRunLoopTimeout::ScopedRunLoopTimeout(base::Location const&, base::TimeDelta, base::RepeatingCallback<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>> ()>)::$_0, base::Location, base::RepeatingCallback<std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>> ()>>, void (base::Location const&)>::Run(base::internal::BindStateBase*, base::Location const&) ./../../base/functional/bind_internal.h:989:12 #5 0x558c872b3da0 in Run ./../../base/functional/callback.h:152:12 #6 0x558c872b3da0 in base::(anonymous namespace)::OnRunLoopTimeout(base::RunLoop*, base::Location const&, base::OnceCallback<void (base::Location const&)>) ./../../base/run_loop.cc:41:25 #7 0x558c872b8fbd in Invoke<void (*)(base::RunLoop *, const base::Location &, base::OnceCallback<void (const base::Location &)>), base::RunLoop *, base::Location, base::RepeatingCallback<void (const base::Location &)> > ./../../base/functional/bind_internal.h:636:12 #8 0x558c872b8fbd in MakeItSo<void (*)(base::RunLoop *, const base::Location &, base::OnceCallback<void (const base::Location &)>), std::Cr::tuple<base::internal::UnretainedWrapper<base::RunLoop, base::unretained_traits::MayNotDangle, (base::RawPtrTraits)0>, base::Location, base::RepeatingCallback<void (const base::Location &)> > > ./../../base/functional/bind_internal.h:925:12 #9 0x558c872b8fbd in RunImpl<void (*)(base::RunLoop *, const base::Location &, base::OnceCallback<void (const base::Location &)>), std::Cr::tuple<base::internal::UnretainedWrapper<base::RunLoop, base::unretained_traits::MayNotDangle, (base::RawPtrTraits)0>, base::Location, base::RepeatingCallback<void (const base::Location &)> >, 0UL, 1UL, 2UL> ./../../base/functional/bind_internal.h:1025:12 #10 0x558c872b8fbd in base::internal::Invoker<base::internal::BindState<void (*)(base::RunLoop*, base::Location const&, base::OnceCallback<void (base::Location const&)>), base::internal::UnretainedWrapper<base::RunLoop, base::unretained_traits::MayNotDangle, (base::RawPtrTraits)0>, base::Location, base::RepeatingCallback<void (base::Location const&)>>, void ()>::RunOnce(base::internal::BindStateBase*) ./../../base/functional/bind_internal.h:976:12 #11 0x558c75bd34b0 in base::OnceCallback<void ()>::Run() && ./../../base/functional/callback.h:152:12 #12 0x558c87326547 in Run ./../../base/functional/callback.h:152:12 #13 0x558c87326547 in base::TaskAnnotator::RunTaskImpl(base::PendingTask&) ./../../base/task/common/task_annotator.cc:178:34 #14 0x558c873b4fd9 in RunTask<(lambda at ../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:488:11)> ./../../base/task/common/task_annotator.h:89:5 #15 0x558c873b4fd9 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWorkImpl(base::LazyNow*) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:486:23 #16 0x558c873b2f33 in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:351:41 #17 0x558c873b6df5 in non-virtual thunk to base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::DoWork() ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:0:0 #18 0x558c87223124 in base::MessagePumpDefault::Run(base::MessagePump::Delegate*) ./../../base/message_loop/message_pump_default.cc:40:55 #19 0x558c873b7e7b in base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(bool, base::TimeDelta) ./../../base/task/sequence_manager/thread_controller_with_message_pump_impl.cc:651:12 #20 0x558c872b2938 in base::RunLoop::Run(base::Location const&) ./../../base/run_loop.cc:134:14 #21 0x558c8615e752 in void ash::assistant::test::ExpectResult<ash::assistant::AssistantManagerService::State>(ash::assistant::AssistantManagerService::State, base::RepeatingCallback<ash::assistant::AssistantManagerService::State ()>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>> const&) ./../../chromeos/ash/components/assistant/test_support/expect_utils.h:49:3 #22 0x558c8614cebe in ash::assistant::(anonymous namespace)::AssistantManagerServiceImplTest::WaitForState(ash::assistant::AssistantManagerService::State) ./../../chromeos/ash/services/assistant/assistant_manager_service_impl_unittest.cc:233:5 #23 0x558c8615d3b9 in ash::assistant::AssistantManagerServiceImplTest_ShouldNotCrashRunningAfterStopped_Test::TestBody() ./../../chromeos/ash/services/assistant/assistant_manager_service_impl_unittest.cc:771:3 ../../chromeos/ash/components/assistant/test_support/expect_utils.h:49: Failure Expected: run_loop.Run() doesn't generate new fatal failures in the current thread. Actual: it does. AssistantManagerStateImpl: Failed waiting for expected result. Expected "3" Got "0" Stack trace: #0 0x558c8615eb1f in void ash::assistant::test::ExpectResult<ash::assistant::AssistantManagerService::State>(ash::assistant::AssistantManagerService::State, base::RepeatingCallback<ash::assistant::AssistantManagerService::State ()>, std::Cr::basic_string<char, std::Cr::char_traits<char>, std::Cr::allocator<char>> const&) ./../../chromeos/ash/components/assistant/test_support/expect_utils.h:49:3 #1 0x558c8614cebe in ash::assistant::(anonymous namespace)::AssistantManagerServiceImplTest::WaitForState(ash::assistant::AssistantManagerService::State) ./../../chromeos/ash/services/assistant/assistant_manager_service_impl_unittest.cc:233:5 #2 0x558c8615d3b9 in ash::assistant::AssistantManagerServiceImplTest_ShouldNotCrashRunningAfterStopped_Test::TestBody() ./../../chromeos/ash/services/assistant/assistant_manager_service_impl_unittest.cc:771:3 [ FAILED ] AssistantManagerServiceImplTest.ShouldNotCrashRunningAfterStopped (30026 ms) Original change's description: > assistant: Prevent timing issue in media_host > > In some situations, the libassistant_media_controller_ inside > media_host_ could be nullptr. In these cases, we need to avoid to call > methods on the nullptr. > > Bug: b:277107422 > Test: added new unittest > Change-Id: If13bd4c887f4641f0cfb8380f3fe604fe288b145 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4404274 > Reviewed-by: Xiaohui Chen <xiaohuic@chromium.org> > Commit-Queue: Tao Wu <wutao@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1126976} Bug: b:277107422 Change-Id: I63c5d52d25c7522e263ba8765da6e0028a4616cf No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4405589 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Owners-Override: Peter Williamson <petewil@chromium.org> Auto-Submit: Peter Williamson <petewil@chromium.org> Commit-Queue: Peter Williamson <petewil@chromium.org> Cr-Commit-Position: refs/heads/main@{#1127244}

This reverts commit 3438f2a. Reason for revert: Suspect causing blink_wpt_tests and blink_web_tests failure on Linux Tests (dbg)(1) bot. Failed tests: blink_wpt_tests failed because of: external/wpt/css/css-contain/content-visibility/detach-locked-slot-children-crash.html external/wpt/css/css-contain/content-visibility/element-reassigned-to-skipped-slot.html external/wpt/css/css-contain/content-visibility/element-reassigned-to-slot-in-skipped-subtree.html external/wpt/html/semantics/forms/the-input-element/focus-dynamic-type-change-on-blur.html ...7 more failure(s) (11 total)... blink_web_tests failed because of: accessibility/details-summary-crash.html fast/events/drag-on-removed-slider-does-not-crash.html fast/forms/range/range-type-change-onchange-2.html html/details_summary/details-add-summary.html ...5 more failure(s) (9 total)... First build failure: https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20Tests%20(dbg)(1)/114032/overview Sample log: --- STDERR: #6 0x7fc01bd0361d logging::CheckError::~CheckError() STDERR: #7 0x7fbffd21d08a blink::FlatTreeTraversal::AssertPrecondition() STDERR: #8 0x7fbffd21cfd5 blink::FlatTreeTraversal::Parent() STDERR: #9 0x7fbffd3c2a45 blink::FlatTreeTraversal::AncestorsOf() STDERR: #10 0x7fbffd3d410e blink::(anonymous namespace)::NearestLockedExclusiveAncestor() STDERR: #11 0x7fbffd3d3d17 blink::DisplayLockUtilities::IsInUnlockedOrActivatableSubtree() STDERR: #12 0x7fbfedfabc4b blink::DisplayLockUtilities::ShouldIgnoreNodeDueToDisplayLock() STDERR: #13 0x7fbfedf8b61c blink::AXObject::ToString() STDERR: #14 0x7fbfedf8eccc blink::AXObject::Detach() STDERR: #15 0x7fbfedf512df blink::AXNodeObject::Detach() STDERR: #16 0x7fbfedf2d6a5 blink::AXLayoutObject::Detach() STDERR: #17 0x7fbfedfce51a blink::AXObjectCacheImpl::Remove() STDERR: #18 0x7fbfedfcd998 blink::AXObjectCacheImpl::Remove() STDERR: #19 0x7fbfedfcdd74 blink::AXObjectCacheImpl::Remove() STDERR: #20 0x7fbfedfce992 blink::AXObjectCacheImpl::Remove() STDERR: #21 0x7fbffe6d16be blink::LayoutObject::WillBeDestroyed() --- Original change's description: > [A11y] Reland targeted cached property invalidation > > Relands the following CLS: > * Enhance performance by targeting value updates to specific nodes, commit 704633e. > * Don't queue anything for irrelevant attribute changes, commit 2c66a62. > * Add comment explaining call to UpdateStyleAndLayoutTreeForNode(), commit 73b9eed. > * Ensure cached values not invalidated during the computation of them, commit 4d167a6. > * Run a test with --force-renderer-accessibility that used to fail, commit cab7ecd. > * Simplify code to update cached focusable state, commit 79cb184. > * Simplify code that invalidates cached values on an AXObject, commit 6df79a5. > > Fixed: 1446864, 1446550, 1434555, 1362758 > Change-Id: I16855bdcb746cb41387b69e1e97ab72ffc47e342 > Cq-Do-Not-Cancel-Tryjobs: true > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4545510 > Commit-Queue: Aaron Leventhal <aleventhal@chromium.org> > Reviewed-by: Jacques Newman <janewman@microsoft.com> > Reviewed-by: Chris Harrelson <chrishtr@chromium.org> > Reviewed-by: Philip Rogers <pdr@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1157878} Change-Id: Iefe59fe1933747346eda8827fd683f310d6cddb3 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4615927 Reviewed-by: Takuto Ikuta <tikuta@chromium.org> Owners-Override: Takuto Ikuta <tikuta@chromium.org> Commit-Queue: Takuto Ikuta <tikuta@chromium.org> Auto-Submit: Takashi Sakamoto <tasak@google.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#1157993}

This reverts commit 7e52434. Reason for revert: the new test is failing, and is likely causing other tests to fail as well. See: https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20ChromiumOS%20MSan%20Tests/37593/test-results?sortby=&groupby= Sample failure: [ RUN ] TimeOfDayTest.ReturnsNullTimeWhenLocalTimeFails ==324697==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x5632f6dd4ee3 in base::Time::Exploded::HasValidValues() const ./../../base/time/time.cc:302:23 #1 0x5632f61d489d in ash::TimeOfDay::ToTimeToday() const ./../../ash/system/time/time_of_day.cc:54:12 #2 0x5632ea366c82 in ash::(anonymous namespace)::TimeOfDayTest_ReturnsNullTimeWhenLocalTimeFails_Test::TestBody() ./../../ash/system/time/time_of_day_unittest.cc:98:3 #3 0x5632f496278c in HandleExceptionsInMethodIfSupported<testing::Test, void> ./../../third_party/googletest/src/googletest/src/gtest-internal-inl.h:0:10 #4 0x5632f496278c in testing::Test::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2670:5 #5 0x5632f49650b3 in testing::TestInfo::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2849:11 #6 0x5632f4967144 in testing::TestSuite::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:3008:30 #7 0x5632f4994c10 in testing::internal::UnitTestImpl::RunAllTests() ./../../third_party/googletest/src/googletest/src/gtest.cc:5866:44 #8 0x5632f4993ce2 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> ./../../third_party/googletest/src/googletest/src/gtest-internal-inl.h:0:10 #9 0x5632f4993ce2 in testing::UnitTest::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:5440:10 #10 0x5632f6f60f30 in RUN_ALL_TESTS ./../../third_party/googletest/src/googletest/include/gtest/gtest.h:2284:73 #11 0x5632f6f60f30 in base::TestSuite::Run() ./../../base/test/test_suite.cc:461:16 #12 0x5632f6f6c137 in Run ./../../base/functional/callback.h:152:12 #13 0x5632f6f6c137 in RunTestSuite ./../../base/test/launcher/unit_test_launcher.cc:179:38 #14 0x5632f6f6c137 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) ./../../base/test/launcher/unit_test_launcher.cc:240:10 #15 0x5632f6f6b824 in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) ./../../base/test/launcher/unit_test_launcher.cc:288:10 #16 0x5632f68395ae in main ./../../ash/test/ash_unittests.cc:29:10 #17 0x7f1f985cd082 in __libc_start_main ??:0:0 #18 0x5632e637b029 in _start ??:0:0 Uninitialized value was created by an allocation of 'now' in the stack frame #0 0x5632f61d4706 in ash::TimeOfDay::ToTimeToday() const ./../../ash/system/time/time_of_day.cc:48:3 Other tests seem to be failing for the same reasons, e.g. ScheduledFeatureTest.HandlesLocalTimeFailuresSunsetToSunrise Original change's description: > Explicitly check when local time conversion fails. > > base::Time::LocalExplode() can fail. The API says to check > base::Time::Exploded::HasValidValues() to detect this. > > This functionally is probably the same as before because we > were passing the exploded output to base::Time::FromLocalExploded() > immediately after, and presumably, that would fail if the exploded > input had invalid values. But it's clearer to the reader if this > is explicitly checked first. > > A unit test has also been added to TimeOfDay. > > Bug: b:294436942 > Change-Id: I751da660df4c89a9c545d465dfb5361dfb2acc64 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4750820 > Reviewed-by: Jiaming Cheng <jiamingc@chromium.org> > Commit-Queue: Eric Sum <esum@google.com> > Cr-Commit-Position: refs/heads/main@{#1179335} Bug: b:294436942 Change-Id: Iee92b34c51d4b202b6018dd1c62ddd4c4f76eaf6 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4748880 Commit-Queue: David Roger <droger@chromium.org> Owners-Override: David Roger <droger@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#1179492}

… LogMessage." This reverts commit 07a88f3. Reason for revert: breaks MSAN bot https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20ChromiumOS%20MSan%20Tests/37602/test-results [ RUN ] CStringBuilderTestPA.Char ==313264==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x563432178a89 in partition_alloc::internal::base::strings::CStringBuilder::c_str() ./../../base/allocator/partition_allocator/partition_alloc_base/strings/cstring_builder.cc:145:7 #1 0x563431d9652c in partition_alloc::internal::base::strings::CStringBuilderTestPA_Char_Test::TestBody() ./../../base/allocator/partition_allocator/partition_alloc_base/strings/cstring_builder_pa_unittest.cc:33:3 #2 0x5634322101ba in HandleExceptionsInMethodIfSupported<testing::Test, void> ./../../third_party/googletest/src/googletest/src/gtest-internal-inl.h:0:10 #3 0x5634322101ba in testing::Test::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2670:5 #4 0x563432212ae1 in testing::TestInfo::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2849:11 #5 0x563432214b72 in testing::TestSuite::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:3008:30 #6 0x563432242552 in testing::internal::UnitTestImpl::RunAllTests() ./../../third_party/googletest/src/googletest/src/gtest.cc:5866:44 #7 0x563432241624 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> ./../../third_party/googletest/src/googletest/src/gtest-internal-inl.h:0:10 #8 0x563432241624 in testing::UnitTest::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:5440:10 #9 0x5634329698b0 in RUN_ALL_TESTS ./../../third_party/googletest/src/googletest/include/gtest/gtest.h:2284:73 #10 0x5634329698b0 in base::TestSuite::Run() ./../../base/test/test_suite.cc:461:16 #11 0x5634329cc377 in Run ./../../base/functional/callback.h:152:12 #12 0x5634329cc377 in RunTestSuite ./../../base/test/launcher/unit_test_launcher.cc:179:38 #13 0x5634329cc377 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) ./../../base/test/launcher/unit_test_launcher.cc:240:10 #14 0x5634329cba64 in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) ./../../base/test/launcher/unit_test_launcher.cc:288:10 #15 0x5634328f3de4 in main ./../../base/test/run_all_unittests.cc:70:10 #16 0x7f308e293082 in __libc_start_main ??:0:0 #17 0x56342e6a1349 in _start ??:0:0 Uninitialized value was created by an allocation of 'builder' in the stack frame #0 0x563431d96365 in partition_alloc::internal::base::strings::CStringBuilderTestPA_Char_Test::TestBody() ./../../base/allocator/partition_allocator/partition_alloc_base/strings/cstring_builder_pa_unittest.cc:31:3 SUMMARY: MemorySanitizer: use-of-uninitialized-value (/b/s/w/ir/out/Release/base_unittests+0x43f5a89) (BuildId: 039152aa25034492) Exiting Original change's description: > [PA] Add CStringBuilder to replace std::ostringstream used by LogMessage. > > Since std::ostringstream allocates and deallocates memory from heap, c.f. https://source.chromium.org/chromium/chromium/src/+/refs/heads/main:buildtools/third_party/libc++/trunk/src/ios.cpp > > std::ostringstream is not available inside memory allocation. Instead > add CStringBuilder (not resize, fixed buffer size) for LogMessage. > > Change-Id: I8051978487acc5fc9b976d6085909b43f81d9d0d > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4744311 > Reviewed-by: Yuki Shiino <yukishiino@chromium.org> > Commit-Queue: Takashi Sakamoto <tasak@google.com> > Cr-Commit-Position: refs/heads/main@{#1179481} Change-Id: Idb29e3252d9fe67955c0ae25ab46640ebfdae336 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4748189 Auto-Submit: David Roger <droger@chromium.org> Owners-Override: David Roger <droger@chromium.org> Commit-Queue: David Roger <droger@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Cr-Commit-Position: refs/heads/main@{#1179539}

This reverts commit 9888813. Reason for revert: Roll forward with msan fix. Original change's description: > Revert "Explicitly check when local time conversion fails." > > This reverts commit 7e52434. > > Reason for revert: the new test is failing, and is likely causing other tests to fail as well. > > See: > https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20ChromiumOS%20MSan%20Tests/37593/test-results?sortby=&groupby= > > Sample failure: > > [ RUN ] TimeOfDayTest.ReturnsNullTimeWhenLocalTimeFails > ==324697==WARNING: MemorySanitizer: use-of-uninitialized-value > #0 0x5632f6dd4ee3 in base::Time::Exploded::HasValidValues() const ./../../base/time/time.cc:302:23 > #1 0x5632f61d489d in ash::TimeOfDay::ToTimeToday() const ./../../ash/system/time/time_of_day.cc:54:12 > #2 0x5632ea366c82 in ash::(anonymous namespace)::TimeOfDayTest_ReturnsNullTimeWhenLocalTimeFails_Test::TestBody() ./../../ash/system/time/time_of_day_unittest.cc:98:3 > #3 0x5632f496278c in HandleExceptionsInMethodIfSupported<testing::Test, void> ./../../third_party/googletest/src/googletest/src/gtest-internal-inl.h:0:10 > #4 0x5632f496278c in testing::Test::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2670:5 > #5 0x5632f49650b3 in testing::TestInfo::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:2849:11 > #6 0x5632f4967144 in testing::TestSuite::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:3008:30 > #7 0x5632f4994c10 in testing::internal::UnitTestImpl::RunAllTests() ./../../third_party/googletest/src/googletest/src/gtest.cc:5866:44 > #8 0x5632f4993ce2 in HandleExceptionsInMethodIfSupported<testing::internal::UnitTestImpl, bool> ./../../third_party/googletest/src/googletest/src/gtest-internal-inl.h:0:10 > #9 0x5632f4993ce2 in testing::UnitTest::Run() ./../../third_party/googletest/src/googletest/src/gtest.cc:5440:10 > #10 0x5632f6f60f30 in RUN_ALL_TESTS ./../../third_party/googletest/src/googletest/include/gtest/gtest.h:2284:73 > #11 0x5632f6f60f30 in base::TestSuite::Run() ./../../base/test/test_suite.cc:461:16 > #12 0x5632f6f6c137 in Run ./../../base/functional/callback.h:152:12 > #13 0x5632f6f6c137 in RunTestSuite ./../../base/test/launcher/unit_test_launcher.cc:179:38 > #14 0x5632f6f6c137 in base::(anonymous namespace)::LaunchUnitTestsInternal(base::OnceCallback<int ()>, unsigned long, int, unsigned long, bool, base::RepeatingCallback<void ()>, base::OnceCallback<void ()>) ./../../base/test/launcher/unit_test_launcher.cc:240:10 > #15 0x5632f6f6b824 in base::LaunchUnitTests(int, char**, base::OnceCallback<int ()>, unsigned long) ./../../base/test/launcher/unit_test_launcher.cc:288:10 > #16 0x5632f68395ae in main ./../../ash/test/ash_unittests.cc:29:10 > #17 0x7f1f985cd082 in __libc_start_main ??:0:0 > #18 0x5632e637b029 in _start ??:0:0 > > Uninitialized value was created by an allocation of 'now' in the stack frame > #0 0x5632f61d4706 in ash::TimeOfDay::ToTimeToday() const ./../../ash/system/time/time_of_day.cc:48:3 > > > Other tests seem to be failing for the same reasons, e.g. > ScheduledFeatureTest.HandlesLocalTimeFailuresSunsetToSunrise > > Original change's description: > > Explicitly check when local time conversion fails. > > > > base::Time::LocalExplode() can fail. The API says to check > > base::Time::Exploded::HasValidValues() to detect this. > > > > This functionally is probably the same as before because we > > were passing the exploded output to base::Time::FromLocalExploded() > > immediately after, and presumably, that would fail if the exploded > > input had invalid values. But it's clearer to the reader if this > > is explicitly checked first. > > > > A unit test has also been added to TimeOfDay. > > > > Bug: b:294436942 > > Change-Id: I751da660df4c89a9c545d465dfb5361dfb2acc64 > > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4750820 > > Reviewed-by: Jiaming Cheng <jiamingc@chromium.org> > > Commit-Queue: Eric Sum <esum@google.com> > > Cr-Commit-Position: refs/heads/main@{#1179335} > > Bug: b:294436942 > Change-Id: Iee92b34c51d4b202b6018dd1c62ddd4c4f76eaf6 > No-Presubmit: true > No-Tree-Checks: true > No-Try: true > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4748880 > Commit-Queue: David Roger <droger@chromium.org> > Owners-Override: David Roger <droger@chromium.org> > Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> > Cr-Commit-Position: refs/heads/main@{#1179492} Bug: b:294436942 Change-Id: I81aca119976bca9c4992f20064b3923146c5ab4d Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4752645 Reviewed-by: James Cook <jamescook@chromium.org> Reviewed-by: Jiaming Cheng <jiamingc@chromium.org> Commit-Queue: Eric Sum <esum@google.com> Cr-Commit-Position: refs/heads/main@{#1181006}

…ation At least on Linux X11, views::test::TestDesktopScreenOzone::Create() may try to retrieve a localized string for "Built-in display" after [1]. But screen creation happens early for interactive UI tests since [2], at least before ChromeFeatureListCreator::ConvertFlagsToSwitches() which assumes ui::ResourceBundle is not initialized. This is causing the crash below for all interactive UI tests on Linux X11, which this CL fixes by temporarily initializing ui::ResourceBundle during screen creation. See crbug.com/1457129 for details. [24841:24841:FATAL:resource_bundle.cc(357)] Check failed: g_shared_instance_ != nullptr. #0 0x5585747ceee2 base::debug::CollectStackTrace() #1 0x5585747b6213 base::debug::StackTrace::StackTrace() #2 0x5585746ab79d logging::LogMessage::~LogMessage() #3 0x5585746ac2ee logging::LogMessage::~LogMessage() #4 0x558574692437 logging::CheckError::~CheckError() #5 0x558574bd6075 ui::ResourceBundle::GetSharedInstance() #6 0x558574bc0a18 l10n_util::GetStringUTF8() #7 0x5585758fddc1 ui::BuildDisplaysFromXRandRInfo() #8 0x5585758fb539 ui::XDisplayManager::FetchDisplayList() #9 0x5585758fb449 ui::XDisplayManager::Init() #10 0x55856dd0e34c ui::X11ScreenOzone::Init() #11 0x55856d09ed3d views::test::TestDesktopScreenOzone::Create() #12 0x558572c7ec70 InProcessBrowserTest::SetScreenInstance() #13 0x558572c7e44f InProcessBrowserTest::SetUp() #14 0x55856d24c5f2 testing::Test::Run() #15 0x55856d24d865 testing::TestInfo::Run() #16 0x55856d24e337 testing::TestSuite::Run() #17 0x55856d25cf07 testing::internal::UnitTestImpl::RunAllTests() #18 0x55856d25c9ff testing::UnitTest::Run() #19 0x5585746730ec base::TestSuite::Run() #20 0x558572c5eddb ChromeTestSuiteRunner::RunTestSuiteInternal() #21 0x55856cc79be4 InteractiveUITestSuiteRunner::RunTestSuite() #22 0x558572c5f069 ChromeTestLauncherDelegate::RunTestSuite() #23 0x558573d7b9ab content::LaunchTestsInternal() #24 0x558572c5f325 LaunchChromeTests() Bug: 1457129 [1] crrev.com/1010705 [2] crrev.com/1011300 Change-Id: I173b41d4369fa26332a37b0f89e14669b6b227a1 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4632804 Commit-Queue: Frédéric Wang <fwang@igalia.com> Reviewed-by: Scott Violet <sky@chromium.org> Cr-Commit-Position: refs/heads/main@{#1191366}

…reen creation" This reverts commit 5931e82. Reason for revert: Suspect causing multiple test failed on Linux Tests (dbg)(1) first failure: https://ci.chromium.org/ui/p/chromium/builders/ci/Linux%20Tests%20(dbg)(1)/115562/overview Original change's description: > interactive_ui_tests: use temporary ui::ResourceBundle for screen creation > > At least on Linux X11, views::test::TestDesktopScreenOzone::Create() may > try to retrieve a localized string for "Built-in display" after [1]. > But screen creation happens early for interactive UI tests since [2], at > least before ChromeFeatureListCreator::ConvertFlagsToSwitches() which > assumes ui::ResourceBundle is not initialized. This is causing the crash > below for all interactive UI tests on Linux X11, which this CL fixes by > temporarily initializing ui::ResourceBundle during screen creation. > See crbug.com/1457129 for details. > > [24841:24841:FATAL:resource_bundle.cc(357)] Check failed: g_shared_instance_ != nullptr. > #0 0x5585747ceee2 base::debug::CollectStackTrace() > #1 0x5585747b6213 base::debug::StackTrace::StackTrace() > #2 0x5585746ab79d logging::LogMessage::~LogMessage() > #3 0x5585746ac2ee logging::LogMessage::~LogMessage() > #4 0x558574692437 logging::CheckError::~CheckError() > #5 0x558574bd6075 ui::ResourceBundle::GetSharedInstance() > #6 0x558574bc0a18 l10n_util::GetStringUTF8() > #7 0x5585758fddc1 ui::BuildDisplaysFromXRandRInfo() > #8 0x5585758fb539 ui::XDisplayManager::FetchDisplayList() > #9 0x5585758fb449 ui::XDisplayManager::Init() > #10 0x55856dd0e34c ui::X11ScreenOzone::Init() > #11 0x55856d09ed3d views::test::TestDesktopScreenOzone::Create() > #12 0x558572c7ec70 InProcessBrowserTest::SetScreenInstance() > #13 0x558572c7e44f InProcessBrowserTest::SetUp() > #14 0x55856d24c5f2 testing::Test::Run() > #15 0x55856d24d865 testing::TestInfo::Run() > #16 0x55856d24e337 testing::TestSuite::Run() > #17 0x55856d25cf07 testing::internal::UnitTestImpl::RunAllTests() > #18 0x55856d25c9ff testing::UnitTest::Run() > #19 0x5585746730ec base::TestSuite::Run() > #20 0x558572c5eddb ChromeTestSuiteRunner::RunTestSuiteInternal() > #21 0x55856cc79be4 InteractiveUITestSuiteRunner::RunTestSuite() > #22 0x558572c5f069 ChromeTestLauncherDelegate::RunTestSuite() > #23 0x558573d7b9ab content::LaunchTestsInternal() > #24 0x558572c5f325 LaunchChromeTests() > > Bug: 1457129 > > [1] crrev.com/1010705 > [2] crrev.com/1011300 > > Change-Id: I173b41d4369fa26332a37b0f89e14669b6b227a1 > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4632804 > Commit-Queue: Frédéric Wang <fwang@igalia.com> > Reviewed-by: Scott Violet <sky@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1191366} Bug: 1457129, 1478318 Change-Id: Ib5adf3d8d8fb0b80789b6351f90cade2d6a6b682 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4833241 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Owen Min <zmin@chromium.org> Reviewed-by: Peter Williamson <petewil@chromium.org> Owners-Override: Owen Min <zmin@chromium.org> Auto-Submit: Owen Min <zmin@chromium.org> Cr-Commit-Position: refs/heads/main@{#1191537}

@AliMariam

@AliMariam reported the dangling pointer detector found a new dangling pointer when running tests on linux Workstation. The error is: ``` The memory was freed at: #3 allocator_shim::internal::PartitionFree() #4 bluez::BluezDBusThreadManager::~BluezDBusThreadManager() #5 bluez::BluezDBusThreadManager::Shutdown() #6 ChromeBrowserMainPartsLinux::PostDestroyThreads() #7 content::BrowserMainLoop::ShutdownThreadsAndCleanUp() #8 content::BrowserMainRunnerImpl::Shutdown() #9 content::BrowserMain() #10 content::RunBrowserProcessMain() #11 content::ContentMainRunnerImpl::RunBrowser() #12 content::ContentMainRunnerImpl::Run() #13 content::RunContentProcess() #14 content::ContentMain() #15 ChromeMain The dangling raw_ptr was released at: #3 base::internal::RawPtrBackupRefImpl<>::ReleaseInternal() #4 dbus::ObjectManager::~ObjectManager() #5 std::__Cr::__tuple_impl<>::~__tuple_impl() #6 base::internal::BindState<>::Destroy() #7 base::[...]::LazilyDeallocatedDeque<>::Ring::~Ring() #8 base::[...]::TaskQueueImpl::UnregisterTaskQueue() #9 base::[...]::SequenceManagerImpl::UnregisterTaskQueueImpl() #10 base::sequence_manager::TaskQueue::ShutdownTaskQueue() #11 content::BrowserTaskQueues::~BrowserTaskQueues() #12 content::BrowserUIThreadScheduler::~BrowserUIThreadScheduler() #13 content::BrowserTaskExecutor::[...]::~UIThreadExecutor() #14 content::BrowserTaskExecutor::[...]::~UIThreadExecutor() #15 content::BrowserTaskExecutor::Shutdown() #16 content::ContentMainRunnerImpl::Shutdown() #17 content::RunContentProcess() #18 content::ContentMain() #19 ChromeMain ``` Diagnostic: - `bluez::BluezDBusThreadManager` owns a `dbus::Bus` as `system_bus`. - `dbus::Bus` owns: - The set of `dbus::ObjectManager` as `object_manager_table_`. - The DBus task runner as `dbus_task_runner_`. - The `dbus::ObjectManager` references `dbus::Bus` via `bus_`. So far so good, the ownership is clear. The problem happens when calling `dbus::Bus::RemoveObjectManager`. Indeed this moves the ObjectManager out of `dbus::Bus` toward a callback to a new thread. This still works transitively, because the dbus::Bus owns the thread. The problem happens after a second transfer back to the original thread. Indeed, there is a race condition possible: Behavior without problems: ----------------------------------- ┌─────────────┐ ┌───────────┐ │Origin thread│ │DBus thread│ └──────┬──────┘ └─────┬─────┘ RemoveObjectManager() │ │────────────────────────────────>│ │ RemoveObjectManagerInternal() │<────────────────────────────────│ RemoveObjectManagerInternalHelper() │ ~ObjectManager() │ │ ┌─────┴─────┐ Shutdown DBus Thread ─────────────>│DBus thread│ Shutdown DBus Thread <─────────────│DBus thread│ │ └───────────┘ ~Bus ┌──────┴──────┐ │Origin thread│ └─────────────┘ Behavior with problems: ---------------------------------------- ┌─────────────┐ ┌───────────┐ │Origin thread│ │DBus thread│ └──────┬──────┘ └─────┬─────┘ RemoveObjectManager() │ │────────────────────────────────>│ │ RemoveObjectManagerInternal() │ ┌────────────│ │ │ ┌─────┴─────┐ Shutdown DBus Thread ─────────────>│DBus thread│ Shutdown DBus Thread <─────────────│DBus thread│ │ │ └───────────┘ ~Bus() │ │ │ │<───────────────────┘ RemoveObjectManagerInternalHelper() ~ObjectManager() ┌──────┴──────┐ │Origin thread│ └─────────────┘ ----------------------------------------------------------------- In the second case: ~Bus() is called before ~ObjectManager(). The fix is a use `ObjectManager::Cleanup()` to cleanup the raw_ptr while the object is still transitively owned by the object it referenced. Bug: chromium:1478759 Fixed: chromium:1478759 Change-Id: I4ac04d449ab8a7b860256c490f8ac878c1c5c7c5 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4839496 Reviewed-by: Ryo Hashimoto <hashimoto@chromium.org> Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org> Cr-Commit-Position: refs/heads/main@{#1192343}

This reverts commit b573ec1. Reason for revert: file read on main thread causes crashes https://ci.chromium.org/ui/p/chrome/builders/ci/chromeos-reven-chrome/9260/overview 2023-12-11T23:44:32.631073Z FATAL chrome[4644:4644]: [thread_restrictions.cc(58)] Check failed: !tls_blocking_disallowed. Function marked as blocking was called from a scope that disallows blocking! If this task is running inside the ThreadPool, it needs to have MayBlock() in its TaskTraits. Otherwise, consider making this blocking work asynchronous or, as a last resort, you may use ScopedAllowBlocking (see its documentation for best practices). tls_blocking_disallowed 1 set by #0 0x580a56a26b42 base::debug::CollectStackTrace() #1 0x580a56a0d4d3 base::debug::StackTrace::StackTrace() #2 0x580a569e746f base::DisallowUnresponsiveTasks() #3 0x580a5391e8ef content::BrowserMainLoop::PreMainMessageLoopRun() #4 0x580a5062f27f base::OnceCallback<>::Run() #5 0x580a540ca43b content::StartupTaskRunner::RunAllTasksNow() #6 0x580a5391e206 content::BrowserMainLoop::CreateStartupTasks() #7 0x580a5392166e content::BrowserMainRunnerImpl::Initialize() #8 0x580a5391bad6 content::BrowserMain() #9 0x580a560952b6 content::RunBrowserProcessMain() #10 0x580a56097a80 content::ContentMainRunnerImpl::RunBrowser() #11 0x580a5609715e content::ContentMainRunnerImpl::Run() #12 0x580a56093df5 content::RunContentProcess() #13 0x580a56093f42 content::ContentMain() #14 0x580a5010c79d ChromeMain #15 0x7d10446316c6 __libc_start_call_main #16 0x7d1044631782 __libc_start_main_alias_2 #17 0x580a5010c531 _start #0 0x580a56a26b42 base::debug::CollectStackTrace() #1 0x580a56a0d4d3 base::debug::StackTrace::StackTrace() #2 0x580a4ffa72c8 logging::LogMessage::~LogMessage() #3 0x580a56923860 logging::(anonymous namespace)::DCheckLogMessage::~DCheckLogMessage() #4 0x580a4ffa6d67 logging::CheckError::~CheckError() #5 0x580a569e680b base::internal::AssertBlockingAllowed() #6 0x580a50037d3b base::ScopedBlockingCall::ScopedBlockingCall() #7 0x580a5fffd0fb base::File::Stat() #8 0x580a56a21ae3 base::GetFileInfo() #9 0x580a5a144486 first_run::GetFirstRunSentinelCreationTime() #10 0x580a55d04f18 ash::ReportControllerInitializer::OwnershipStatusChanged() #11 0x580a55d3a722 ash::DeviceSettingsService::NotifyOwnershipStatusChanged() #12 0x580a55d39e59 ash::DeviceSettingsService::HandleCompletedOperation() #13 0x580a55d3a0c8 ash::DeviceSettingsService::HandleCompletedAsyncOperation() #14 0x580a538a96d8 base::internal::FunctorTraits<>::Invoke<>() #15 0x580a55d3a8c2 base::internal::Invoker<>::RunOnce() Original change's description: > Create ReportInitializer that checks for browser preconditions > > Introduce ReportControllerInitializer class in chrome/browser/ash, > functioning as a DeviceSettingsService::Observer. The class waits for > the OwnershipStatusChanged callback with ownership status indicating > device ownership, checks for the presence of the .oobe_completed file, > and waits for CrosSettings::PrepareTrustedValues to signal TRUSTED > status. > > Only after these preconditions are met does the class proceed > to initialize the ReportController. > > BUG=chromium:1504019 > > Change-Id: I0bd93c2eb9f83669ea23395d59b292a4cc858bcb > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5047743 > Reviewed-by: Xiyuan Xia <xiyuan@chromium.org> > Commit-Queue: Hirthanan Subenderan <hirthanan@google.com> > Reviewed-by: Pavol Marko <pmarko@chromium.org> > Cr-Commit-Position: refs/heads/main@{#1235879} Bug: chromium:1504019 Change-Id: If41cc3e2fa0330afa6cb5aeb84f05efd1e614669 No-Presubmit: true No-Tree-Checks: true No-Try: true Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5113660 Auto-Submit: Joel Hockey <joelhockey@chromium.org> Reviewed-by: Hirthanan Subenderan <hirthanan@google.com> Commit-Queue: Joel Hockey <joelhockey@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Reviewed-by: James Cook <jamescook@chromium.org> Cr-Commit-Position: refs/heads/main@{#1236048}

...triggers entry doom and thus ends up running the operation queue in the wrong spot of creation (and entry op) completion handler. This can among other things result in this madness: #6 disk_cache::SimpleEntryImpl::CloseInternal() #7 disk_cache::SimpleEntryImpl::RunNextOperationIfNeeded() #8 SimpleEntryImpl::ScopedOperationRunner::~ScopedOperationRunner() #9 disk_cache::SimpleEntryImpl::WriteDataInternal() #10 disk_cache::SimpleEntryImpl::RunNextOperationIfNeeded() #11 SimpleEntryImpl::ScopedOperationRunner::~ScopedOperationRunner() #12 disk_cache::SimpleEntryImpl::WriteDataInternal() #13 disk_cache::SimpleEntryImpl::RunNextOperationIfNeeded() #14 disk_cache::SimpleEntryImpl::DoomEntry() #15 disk_cache::SimpleBackendImpl::DoomEntryFromHash() #16 disk_cache::SimpleBackendImpl::DoomEntries() #17 disk_cache::SimpleIndex::StartEvictionIfNeeded() #18 disk_cache::SimpleIndex::UpdateEntrySize() #19 disk_cache::SimpleEntryImpl::UpdateDataFromEntryStat() #20 disk_cache::SimpleEntryImpl::CreationOperationComplete() (namespace elided twice to avoid wrapping). ... which means we end up at the in_results = nullptr line near the bottom of CreationOperationComplete with null `synchronous_entry_`(!) (and a dangling in_results->sync_entry, where one would expect the two to be aliases). I *think* we won't actually deliver a callback from this state since we likely needed to be in optimistic path to got thus far, but I am not certain. Similarly, when this sort of thing happens from within read/write ops, it could potentially cause callbacks to be delivered in wrong order if the queued op ends up being a stream 0 operation, which can be executed without a round trip to a worker thread. Change-Id: Iac8058f0d18225677e361c6cdddf92d28fb4833f Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5054619 Reviewed-by: Adam Rice <ricea@chromium.org> Reviewed-by: Kenichi Ishibashi <bashi@chromium.org> Commit-Queue: Maks Orlovich <morlovich@chromium.org> Cr-Commit-Position: refs/heads/main@{#1248862}

While investigating a black stripe that appears on the right border of a lacros window while it is been resized horizontally from the opposite border (left), it was figured that depending on the values of the window `origin`, `size` and `scale factor`, the black line was appearing or hidden. A continuous interactive window resize is the perfect scenario to replicate the bug intermittently, and give users the impression of a flashing black line. As an easy way to illustrate the issue, lets assume a lacros window with the following bounds in DIPS, `330,0 596x664`, and a device scale factor of `1.62574` - these values can replicate the problem of the vertical stripe appearing even without triggering a window resize. For instance, this bounds in DIPS becomes `536,0 970x1080` in pixels using DesktopWindowTreeHostPlatform::ConvertRectToPixels(). 1.1) During the window creation, the `ui::Compositor` instance gets its scale factor and size set in pixels. It happens when `Compositor::SetScaleAndSize()` is called. This is the stracktrace: ```` #1 0x592718b9d713 base::debug::StackTrace::StackTrace() #2 0x5927205f4655 ui::Compositor::SetScaleAndSize() #3 0x5927205eac3e aura::WindowTreeHost::UpdateCompositorScaleAndSize() #4 0x5927205ec714 aura::WindowTreeHost::OnHostResizedInPixels() #5 0x592721d2dc2e aura::WindowTreeHostPlatform::OnBoundsChanged() #6 0x592721d2cc40 views::DesktopWindowTreeHostLacros::OnBoundsChanged() #7 0x592721d2e1b9 aura::WindowTreeHostPlatform::OnStateUpdate() #8 0x592719b83731 ui::WaylandWindow::MaybeApplyLatestStateRequest() #9 0x592719b83074 ui::WaylandWindow::RequestState() #10 0x592719b7e189 ui::WaylandWindow::SetWindowScale() #11 0x592719b7d985 ui::WaylandWindow::UpdateWindowScale() #12 0x592719b789ad ui::WaylandToplevelWindow::UpdateWindowScale() #13 0x592719b77f15 ui::WaylandToplevelWindow::Show() #14 0x592721d3139d views::DesktopWindowTreeHostPlatform::Show() #15 0x592721d18b24 views::DesktopNativeWidgetAura::Show() #16 0x592721cd0a7c views::Widget::Show() #17 0x592724d06ffb BrowserView::Show() (...) ```` In practice, `aura::WindowTreeHostPlatform::OnBoundsChanged()` (frame #4) calls out to `WaylandWindow::GetBoundsInPixels()`, that translates `330,0 596x664` in DIPS to `536,0 970x1080` in pixels - see the method below. Ultimately, only the size is set to the ui::Compositor instance, ie `970x1080`. ```` void WindowTreeHostPlatform::OnBoundsChanged(const BoundsChange& change) { (...) float current_scale = compositor()->device_scale_factor(); float new_scale = ui::GetScaleFactorForNativeView(window()); auto weak_ref = GetWeakPtr(); auto new_size = GetBoundsInPixels().size(); <------ ````` 1.2) Meanwhile, `cc::Layer` instances for the window are also being created. During the layer tree creation, the layers' bounds are all set in DIPs. For instance, the root layer is created with an origin of `0,0` and bounds `596x664`, eg: ```` 2024-03-11T18:42:45.387311Z WARNING chrome[29500:29500]: [layer.cc(390)] #0 0x59271e998ce2 base::debug::CollectStackTrace() #1 0x592718b9d713 base::debug::StackTrace::StackTrace() #2 0x592725cc29d7 cc::Layer::SetBounds() #3 0x592725e2ee96 ui::Layer::SetBoundsFromAnimation() #4 0x5927265c0177 ui::LayerAnimator::SetBounds() #5 0x5927205d8fe0 aura::Window::SetBoundsInternal() #6 0x5927205d8f67 aura::Window::SetBounds() #7 0x5927205ea78e aura::WindowTreeHost::UpdateRootWindowSize() #8 0x5927205ea6df aura::WindowTreeHost::InitHost() #9 0x592721d30b36 views::DesktopWindowTreeHostPlatform::Init() #10 0x592721d16336 views::DesktopNativeWidgetAura::InitNativeWidget() #11 0x592725142c44 DesktopBrowserFrameAura::InitNativeWidget() #12 0x592721ccdd41 views::Widget::Init() #13 0x592724cf68af BrowserFrame::InitBrowserFrame() #14 0x592724db9f30 BrowserWindow::CreateBrowserWindow() #15 0x592724951ce0 Browser::Browser() #16 0x5927249511c6 Browser::Create() (...) ```` The layers' bounds get translated at places like `draw_property_utils.cc` `ComputeLocalRectInTargetSpace()`, with MathUtils::MapXXX() functions. In practice, `596x664` translates to `968.942x1079.49`, and finally gets rounded to `969x1080`. Hence, we have a root ui::Compositor size of 970x1080 and a root cc:Layer bounds of 969x1080. Using the visual debugger tool attached to lacros, one can see that all window-wide tiles's width are 969 [1]. OTOH, with the visual debugger tool attached to ash/chrome, we can see that the width the the root surface (lacros) is 970 [2]. This 1px different creates a "punch role" effect in the lacros window, and user sees whatever is underneath it rendered [3]. In the case of this bug, what the user sees is a trailing 1px wide line part of the so called "resize shadow". The user sees it through this unintentionally "punch hole" explained above. This CL changes the way PlatformWindowDelegate::State::size_px variable gets set in WaylandWindow::RequestState(), translating only its size from DIPs to pixels. This way we match how this variable is used in ui::Compositor level and cc::Layers et al (tiles, quads, overlayers, etc). As a way to illustrate the problem, see video [4]. It forcibly paints the 1px lacros root layer transparent buffer red with viz_debugger, so one can clearly see it "flashing" due to the rounding error being fixed here. [1] https://issues.chromium.org/u/0/action/issues/40876438/attachments/54873934 [2] https://issues.chromium.org/u/0/action/issues/40876438/attachments/54878944 [3] https://issues.chromium.org/u/0/action/issues/40876438/attachments/54873933 [4] https://issues.chromium.org/action/issues/40876438/attachments/54936907 Bug: 40876438 Change-Id: Id36476d41e7a2c90f8a44337731a4cfad93e6a13 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5384752 Reviewed-by: Maksim Sisov <msisov@igalia.com> Commit-Queue: Antonio Gomes <tonikitoo@igalia.com> Cr-Commit-Position: refs/heads/main@{#1281135}

Attempting to initialize the GPU triggers MSan failures in GL with eager checks enabled in MSan: Uninitialized bytes in strlen at offset 0 inside [0x70200013dec0, 30) ==589==WARNING: MemorySanitizer: use-of-uninitialized-value #0 0x7fffeeba96de in glLabelObjectEXT (/lib/x86_64-linux-gnu/libGLX_mesa.so.0+0x4f6de) #1 0x7fffeeba9b10 in glLabelObjectEXT (/lib/x86_64-linux-gnu/libGLX_mesa.so.0+0x4fb10) #2 0x7fffeeb879a3 (/lib/x86_64-linux-gnu/libGLX_mesa.so.0+0x2d9a3) #3 0x7fffeeb894c0 (/lib/x86_64-linux-gnu/libGLX_mesa.so.0+0x2f4c0) #4 0x7fffeeb8e400 (/lib/x86_64-linux-gnu/libGLX_mesa.so.0+0x34400) #5 0x7fffeeb8f384 (/lib/x86_64-linux-gnu/libGLX_mesa.so.0+0x35384) #6 0x7fffeeb8bd9a (/lib/x86_64-linux-gnu/libGLX_mesa.so.0+0x31d9a) #7 0x7fffecceb484 in queryExtensionsString third_party/angle/src/libANGLE/renderer/gl/glx/FunctionsGLX.cpp:354:12 #8 0x7fffecceb484 in rx::FunctionsGLX::initialize(_XDisplay*, int, std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>>*) third_party/angle/src/libANGLE/renderer/gl/glx/FunctionsGLX.cpp:223:30 #9 0x7fffeccdada2 in rx::DisplayGLX::initialize(egl::Display*) third_party/angle/src/libANGLE/renderer/gl/glx/DisplayGLX.cpp:114:15 #10 0x7fffec70f649 in egl::Display::initialize() third_party/angle/src/libANGLE/Display.cpp:1082:36 #11 0x7fffec0bed17 in egl::Initialize(egl::Thread*, egl::Display*, int*, int*) third_party/angle/src/libGLESv2/egl_stubs.cpp:514:5 #12 0x7fffec0c6319 in EGL_Initialize third_party/angle/src/libGLESv2/entry_points_egl_autogen.cpp:571:27 #13 0x7fffefc4000d in eglInitialize third_party/angle/src/libEGL/libEGL_autogen.cpp:177:12 #14 0x5555868ec92a in gl::GLDisplayEGL::InitializeDisplay(bool, std::__Cr::vector<gl::DisplayType, std::__Cr::allocator<gl::DisplayType>>, gl::EGLDisplayPlatform, gl::GLDisplayEGL*) ui/gl/gl_display.cc:769:10 #15 0x5555868eb310 in gl::GLDisplayEGL::Initialize(bool, std::__Cr::vector<gl::DisplayType, std::__Cr::allocator<gl::DisplayType>>, gl::EGLDisplayPlatform) ui/gl/gl_display.cc:660:8 #16 0x55556c6f1957 in ui::GLOzoneEGL::InitializeGLOneOffPlatform(bool, std::__Cr::vector<gl::DisplayType, std::__Cr::allocator<gl::DisplayType>>, gl::GpuPreference) ui/ozone/common/gl_ozone_egl.cc:25:17 #17 0x55558b1a8999 in gl::init::InitializeGLOneOffPlatform(gl::GpuPreference) ui/gl/init/gl_initializer_ozone.cc:27:26 #18 0x55558b1a6978 in gl::init::InitializeGLOneOffPlatformImplementation(bool, bool, bool, gl::GpuPreference) ui/gl/init/gl_factory.cc:211:24 #19 0x55558b1a6208 in gl::init::(anonymous namespace)::InitializeGLOneOffPlatformHelper(bool, gl::GpuPreference) ui/gl/init/gl_factory.cc:135:10 #20 0x55558b1a662d in gl::init::InitializeGLNoExtensionsOneOff(bool, gl::GpuPreference) ui/gl/init/gl_factory.cc:166:10 #21 0x55558b227379 in gpu::GpuInit::InitializeAndStartSandbox(base::CommandLine*, gpu::GpuPreferences const&) gpu/ipc/service/gpu_init.cc:495:18 #22 0x55559ab41ce4 in content::GpuMain(content::MainFunctionParams) content/gpu/gpu_main.cc:358:39 #23 0x55557b5888da in content::RunZygote(content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:685:14 #24 0x55557b58abad in content::RunOtherNamedProcessTypeMain(std::__Cr::basic_string<char, std::__Cr::char_traits<char>, std::__Cr::allocator<char>> const&, content::MainFunctionParams, content::ContentMainDelegate*) content/app/content_main_runner_impl.cc:789:12 #25 0x55557b58e4fe in content::ContentMainRunnerImpl::Run() content/app/content_main_runner_impl.cc:1156:10 #26 0x55557b585aaf in content::RunContentProcess(content::ContentMainParams, content::ContentMainRunner*) content/app/content_main.cc:332:36 #27 0x55557b58644a in content::ContentMain(content::ContentMainParams) content/app/content_main.cc:345:10 #28 0x555580df9c37 in content::LaunchTestsInternal(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:385:12 #29 0x555580dfab58 in content::LaunchTests(content::TestLauncherDelegate*, unsigned long, int, char**) content/public/test/test_launcher.cc:504:10 #30 0x555582b8afec in LaunchChromeTests(unsigned long, content::TestLauncherDelegate*, int, char**) chrome/test/base/chrome_test_launcher.cc:392:10 #31 0x55557d422a0e in main chrome/test/base/browser_tests_main.cc:60:10 #32 0x7ffff48456c9 in __libc_start_call_main csu/../sysdeps/nptl/libc_start_call_main.h:58:16 #33 0x7ffff4845784 in __libc_start_main csu/../csu/libc-start.c:360:3 #34 0x55555e647029 in _start (/usr/local/google/home/dcheng/src/chrome/src/out/msan/browser_tests+0x90f3029) (BuildId: 6cbc295b16ac1107) Uninitialized value was created by a heap allocation #0 0x55555e675a22 in malloc /b/s/w/ir/cache/builder/src/third_party/llvm/compiler-rt/lib/msan/msan_interceptors.cpp:1021:3 #1 0x7ffff489b087 in __vasprintf_internal libio/vasprintf.c:116:16 #2 0x4ae8d349882b18ff (<unknown module>) Bug: 40240570 Change-Id: If59faa297e214b7219ebb4c5c9572b44a33ee070 Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5548826 Reviewed-by: Elad Alon <eladalon@chromium.org> Commit-Queue: Daniel Cheng <dcheng@chromium.org> Cr-Commit-Position: refs/heads/main@{#1303583}

v8-ci-autoroll-builder and others added 30 commits September 22, 2021 14:45

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[pull] master from chromium:master #16

[pull] master from chromium:master #16

pull bot commented Sep 22, 2021 •

edited

Loading

[pull] master from chromium:master #16

[pull] master from chromium:master #16

Conversation

pull bot commented Sep 22, 2021 • edited Loading

pull bot commented Sep 22, 2021 •

edited

Loading