Fix reentrancy crash when hint popover closing mutates auto ancestor [chromium/src : main]

0 views
Skip to first unread message

Mason Freed (Gerrit)

unread,
Mar 31, 2026, 1:03:43 PM (2 days ago) Mar 31
to David Baron, chromium...@chromium.org, AyeAye, Chromium LUCI CQ, blink-...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org
Attention needed from David Baron

Mason Freed voted and added 3 comments

Votes added by Mason Freed

Auto-Submit+1

3 comments

Commit Message
Line 9, Patchset 2:When showing an `auto` or `hint` popover, `CloseEntirePopoverStack`
David Baron . unresolved

Is this specific to `CloseEntirePopoverStack`, or does it also apply to `HideAllPopoversUntil`?

Mason Freed

I've reworded the commit description. LMK what you think.

File third_party/blink/renderer/core/html/html_element.cc
Line 1592, Patchset 2: "the popover.");
David Baron . resolved

maybe "while hiding all hint popovers"?

(The existing message below also seems like it could be improved.)

Mason Freed

Done

Line 1601, Patchset 2: if (auto* auto_ancestor =
David Baron . unresolved

It seems a bit weird that the handling for the "auto popover" case and the error handling for the "hint popover with an ancestor in the auto stack" case are different, given that the underlying behavior (close the whole hint stack and part of the auto stack) seems to be the same.

Is there a reason you didn't want the same (simpler, I think) fix in this branch?

Mason Freed

Hmm, yes I agree this is a bit weird. And still broken. I've attempted to merge these and add a test case proving the problem. LMK if that's what you were going for.

Open in Gerrit

Related details

Attention is currently required from:
  • David Baron
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedNo-Unresolved-Comments
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: Ia38283f58d957ce02d355a096c66713d6b6cb16a
Gerrit-Change-Number: 7709272
Gerrit-PatchSet: 6
Gerrit-Owner: Mason Freed <mas...@chromium.org>
Gerrit-Reviewer: David Baron <dba...@chromium.org>
Gerrit-Reviewer: Mason Freed <mas...@chromium.org>
Gerrit-Attention: David Baron <dba...@chromium.org>
Gerrit-Comment-Date: Tue, 31 Mar 2026 17:03:34 +0000
Gerrit-HasComments: Yes
Gerrit-Has-Labels: Yes
Comment-In-Reply-To: David Baron <dba...@chromium.org>
satisfied_requirement
unsatisfied_requirement
open
diffy

David Baron (Gerrit)

unread,
Mar 31, 2026, 3:00:15 PM (2 days ago) Mar 31
to Mason Freed, David Baron, chromium...@chromium.org, AyeAye, Chromium LUCI CQ, blink-...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org
Attention needed from Mason Freed

David Baron voted and added 3 comments

Votes added by David Baron

Code-Review+1

3 comments

Patchset-level comments
File-level comment, Patchset 6 (Latest):
David Baron . resolved

LGTM with one comment

File third_party/blink/renderer/core/html/html_element.cc
Line 1588, Patchset 6 (Latest): append_to_stack = &auto_stack;
David Baron . unresolved

So you're not changing anything here -- but I'm a little confused as to why (both before and after this change) you sometimes append hint popovers to the auto stack. Maybe that at least deserves a comment?

Line 1601, Patchset 2: if (auto* auto_ancestor =
David Baron . resolved

It seems a bit weird that the handling for the "auto popover" case and the error handling for the "hint popover with an ancestor in the auto stack" case are different, given that the underlying behavior (close the whole hint stack and part of the auto stack) seems to be the same.

Is there a reason you didn't want the same (simpler, I think) fix in this branch?

Mason Freed

Hmm, yes I agree this is a bit weird. And still broken. I've attempted to merge these and add a test case proving the problem. LMK if that's what you were going for.

David Baron

ok, I didn't realize the difference actually *mattered*, I just throught it was odd.

Open in Gerrit

Related details

Attention is currently required from:
  • Mason Freed
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: Ia38283f58d957ce02d355a096c66713d6b6cb16a
    Gerrit-Change-Number: 7709272
    Gerrit-PatchSet: 6
    Gerrit-Owner: Mason Freed <mas...@chromium.org>
    Gerrit-Reviewer: David Baron <dba...@chromium.org>
    Gerrit-Reviewer: Mason Freed <mas...@chromium.org>
    Gerrit-Attention: Mason Freed <mas...@chromium.org>
    Gerrit-Comment-Date: Tue, 31 Mar 2026 19:00:04 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: Yes
    Comment-In-Reply-To: Mason Freed <mas...@chromium.org>
    Comment-In-Reply-To: David Baron <dba...@chromium.org>
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Mason Freed (Gerrit)

    unread,
    Apr 1, 2026, 8:24:58 PM (10 hours ago) Apr 1
    to David Baron, chromium...@chromium.org, AyeAye, Chromium LUCI CQ, blink-...@chromium.org, blink-rev...@chromium.org, blink-revie...@chromium.org
    Attention needed from David Baron

    Mason Freed added 1 comment

    File third_party/blink/renderer/core/html/html_element.cc
    Line 1588, Patchset 6 (Latest): append_to_stack = &auto_stack;
    David Baron . unresolved

    So you're not changing anything here -- but I'm a little confused as to why (both before and after this change) you sometimes append hint popovers to the auto stack. Maybe that at least deserves a comment?

    Mason Freed

    Yeah, that's the subject of a long (and only recent) discussion:

    https://github.com/whatwg/html/issues/12304#issuecomment-4173002767

    I'm loath to add a comment pointing to that in the codebase. But I also don't have a great rationale that stands up to scrutiny. This behavior is likely to be changing soon.

    LMK what you think I should do here.

    Open in Gerrit

    Related details

    Attention is currently required from:
    • David Baron
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: Ia38283f58d957ce02d355a096c66713d6b6cb16a
    Gerrit-Change-Number: 7709272
    Gerrit-PatchSet: 6
    Gerrit-Owner: Mason Freed <mas...@chromium.org>
    Gerrit-Reviewer: David Baron <dba...@chromium.org>
    Gerrit-Reviewer: Mason Freed <mas...@chromium.org>
    Gerrit-Attention: David Baron <dba...@chromium.org>
    Gerrit-Comment-Date: Thu, 02 Apr 2026 00:24:48 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: No
    Comment-In-Reply-To: David Baron <dba...@chromium.org>
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy
    Reply all
    Reply to author
    Forward
    0 new messages