Drop defensive CopyOnWriteArrayList from the optimized RealContentScopeScripts

[anikiki]

Task/Issue URL: https://app.asana.com/1/137249556945/project/1200905986587319/task/1217019532582642?focus=true
Tech Design URL (if applicable):
API Proposals URL(s) (if applicable):

Description

Two privacy-config lists were rebuilt in place on a worker thread while readers read them on the main thread, and both repositories handed out the live instance.

RealUnprotectedTemporaryRepository did clear() then one add() per row, so a reader could observe any prefix — a millisecond-wide window on every config persist, with ~300 exception domains.
RealContentScopeScripts reads that list on every navigation and serializes it into the injected script, so a truncated read meant content-scope features running on sites meant to be exempt.

Both repositories now build the list aside and publish it in a single assignment to a @Volatile field, following RealTrackerAllowlistRepository in the same module. UnprotectedTemporaryRepository.exceptionswidens from CopyOnWriteArrayList<FeatureException> to List<FeatureException>; no -api change, and existing test stubs are unaffected. RealUserAllowListRepository used a single addAll() so it could never tear, and is included for the second reason below.

Because a published list is now immutable, the optimized path in RealContentScopeScripts drops its two defensive CopyOnWriteArrayList copies and holds the references instead, comparing !== then !=: identity settles the unchanged case in O(1), and equals still stops a reload that changed nothing from reassembling the script. The legacy path keeps its copies and now clears the optimized baselines, so a mid-session flag flip followed by an input returning to its pre-flip value cannot leave the shared JSON stale.

Steps to test this PR

• Tests are passing.

With optimizeContentScopeInjection ON (default on internal)

• Browse several pages in a row, confirm protections stay applied.
• Override the privacy config from dev settings, confirm an unprotectedTemporary change takes effect.
• Tap the shield to allowlist a site, confirm protections drop, then re-protect it.
• Toggle GPC and Accessibility → force zoom, reload, confirm both take effect. (i.e. YouTube)
• Turn the flag OFF, restart, repeat the above. Behaviour must be identical to develop.
• Flip it back ON without restarting, load a page, confirm protections are still correct.

NO UI changes

---

Note

Medium Risk
Changes threading and caching for privacy exemptions and injected content-scope JS; incorrect behavior would mis-apply protections, but the change is well-tested around flag flips and list immutability.

Overview
Fixes a race where RealUnprotectedTemporaryRepository and RealUserAllowListRepository rebuilt CopyOnWriteArrayList in place while readers (including content-scope script injection on every navigation) could see truncated exception or allowlist data.

Both repositories now build aside and assign a new List to a @Volatile field. UnprotectedTemporaryRepository.exceptions is typed as List<FeatureException> instead of the live CopyOnWriteArrayList. Failed reloads keep the previous snapshot; returned lists are not mutated after publish.

In RealContentScopeScripts, the optimized path drops defensive CopyOnWriteArrayList copies and uses reference + equality change detection (differsFrom) so equal content on a new list instance does not reassemble the script. resetCaches() runs when optimizeContentScopeInjection flips mid-session so legacy and optimized baselines cannot leave shared JSON stale after flag toggles.

^{Reviewed by Cursor Bugbot for commit 605346c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[anikiki]

• Stop resolving contentScope experiments on every navigation #9351
• Move ContentScopeScripts inbound JS messages off the JavaBridge thread #9350
• Drop defensive CopyOnWriteArrayList from the optimized RealContentScopeScripts #9347 👈 (View in Graphite)
• Improve RealContentScopeScripts.getScript() #9335
• develop

This stack of pull requests is managed by Graphite. Learn more about stacking.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5927434. Configure here.}

[CrisBarreiro]

While we're here, can we move this from init to onCreate from MainProcessLifecycleObserver?

[anikiki]

@CrisBarreiro I think it's bigger than it looks, and it's better to do it as a follow-up as part of the modularization AoI.

privacy-config-store currently has no di and no lifecycle dependencies. Implementing MainProcessLifecycleObserver means adding :di + lifecycle-runtime to a pure persistence module. Other classes in the same module (ContentBlocking, Gpc, Https, Drm, etc) use the identical init pattern, so doing just this one makes the module inconsistent.