Fix Use-After-Free in TransientWindowManager hide cascade [chromium/src : main]

0 views
Skip to first unread message

Mitsuru Oshima (Gerrit)

unread,
Jul 24, 2026, 3:12:17 PM (yesterday) Jul 24
to Achuith Bhandarkar, Chromium LUCI CQ, chromium...@chromium.org
Attention needed from Achuith Bhandarkar

Mitsuru Oshima voted Commit-Queue+1

Commit-Queue+1
Open in Gerrit

Related details

Attention is currently required from:
  • Achuith Bhandarkar
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement is not satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: Ic5f4b3c32a03f75e95ce7c26dd2bc7f41b9ae097
Gerrit-Change-Number: 8143759
Gerrit-PatchSet: 6
Gerrit-Owner: Mitsuru Oshima <osh...@chromium.org>
Gerrit-Reviewer: Achuith Bhandarkar <ach...@chromium.org>
Gerrit-Reviewer: Mitsuru Oshima <osh...@chromium.org>
Gerrit-Attention: Achuith Bhandarkar <ach...@chromium.org>
Gerrit-Comment-Date: Fri, 24 Jul 2026 19:12:04 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: Yes
satisfied_requirement
unsatisfied_requirement
open
diffy

Achuith Bhandarkar (Gerrit)

unread,
Jul 24, 2026, 3:48:34 PM (24 hours ago) Jul 24
to Mitsuru Oshima, Chromium LUCI CQ, chromium...@chromium.org
Attention needed from Mitsuru Oshima

Achuith Bhandarkar voted and added 2 comments

Votes added by Achuith Bhandarkar

Code-Review+1

2 comments

File ui/wm/core/transient_window_manager.cc
Line 241, Patchset 6 (Latest): // Hiding transient children may delete parent as well.
Achuith Bhandarkar . unresolved

trailing whitespace.

File ui/wm/core/transient_window_manager_unittest.cc
Line 747, Patchset 6 (Latest): class DeleteParentOnHideObserver : public aura::WindowObserver {
Achuith Bhandarkar . unresolved

I don't think this is consistent with chromium style to declare a class in the middle of a function body. You should ask jetski to put it in the anon namespace.

Open in Gerrit

Related details

Attention is currently required from:
  • Mitsuru Oshima
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement satisfiedCode-Review
    • requirement is not satisfiedNo-Unresolved-Comments
    • requirement satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: Ic5f4b3c32a03f75e95ce7c26dd2bc7f41b9ae097
    Gerrit-Change-Number: 8143759
    Gerrit-PatchSet: 6
    Gerrit-Owner: Mitsuru Oshima <osh...@chromium.org>
    Gerrit-Reviewer: Achuith Bhandarkar <ach...@chromium.org>
    Gerrit-Reviewer: Mitsuru Oshima <osh...@chromium.org>
    Gerrit-Attention: Mitsuru Oshima <osh...@chromium.org>
    Gerrit-Comment-Date: Fri, 24 Jul 2026 19:48:25 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: Yes
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Mitsuru Oshima (Gerrit)

    unread,
    Jul 24, 2026, 4:47:57 PM (23 hours ago) Jul 24
    to Achuith Bhandarkar, Chromium LUCI CQ, chromium...@chromium.org

    Mitsuru Oshima voted and added 2 comments

    Votes added by Mitsuru Oshima

    Commit-Queue+1

    2 comments

    File ui/wm/core/transient_window_manager.cc
    Line 241, Patchset 6: // Hiding transient children may delete parent as well.
    Achuith Bhandarkar . resolved

    trailing whitespace.

    Mitsuru Oshima

    Fix applied.

    File ui/wm/core/transient_window_manager_unittest.cc
    Line 747, Patchset 6: class DeleteParentOnHideObserver : public aura::WindowObserver {
    Achuith Bhandarkar . resolved

    I don't think this is consistent with chromium style to declare a class in the middle of a function body. You should ask jetski to put it in the anon namespace.

    Mitsuru Oshima

    Fix applied.

    Open in Gerrit

    Related details

    Attention set is empty
    Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement satisfiedCode-Owners
      • requirement satisfiedCode-Review
      • requirement satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: Ic5f4b3c32a03f75e95ce7c26dd2bc7f41b9ae097
      Gerrit-Change-Number: 8143759
      Gerrit-PatchSet: 7
      Gerrit-Owner: Mitsuru Oshima <osh...@chromium.org>
      Gerrit-Reviewer: Achuith Bhandarkar <ach...@chromium.org>
      Gerrit-Reviewer: Mitsuru Oshima <osh...@chromium.org>
      Gerrit-Comment-Date: Fri, 24 Jul 2026 20:47:48 +0000
      Gerrit-HasComments: Yes
      Gerrit-Has-Labels: Yes
      Comment-In-Reply-To: Achuith Bhandarkar <ach...@chromium.org>
      satisfied_requirement
      open
      diffy

      Mitsuru Oshima (Gerrit)

      unread,
      Jul 24, 2026, 5:53:01 PM (22 hours ago) Jul 24
      to Achuith Bhandarkar, Chromium LUCI CQ, chromium...@chromium.org

      Mitsuru Oshima voted Commit-Queue+2

      Commit-Queue+2
      Open in Gerrit

      Related details

      Attention set is empty
      Submit Requirements:
      • requirement satisfiedCode-Coverage
      • requirement satisfiedCode-Owners
      • requirement satisfiedCode-Review
      • requirement satisfiedReview-Enforcement
      Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
      Gerrit-MessageType: comment
      Gerrit-Project: chromium/src
      Gerrit-Branch: main
      Gerrit-Change-Id: Ic5f4b3c32a03f75e95ce7c26dd2bc7f41b9ae097
      Gerrit-Change-Number: 8143759
      Gerrit-PatchSet: 7
      Gerrit-Owner: Mitsuru Oshima <osh...@chromium.org>
      Gerrit-Reviewer: Achuith Bhandarkar <ach...@chromium.org>
      Gerrit-Reviewer: Mitsuru Oshima <osh...@chromium.org>
      Gerrit-Comment-Date: Fri, 24 Jul 2026 21:52:49 +0000
      Gerrit-HasComments: No
      Gerrit-Has-Labels: Yes
      satisfied_requirement
      open
      diffy

      Mitsuru Oshima (Gerrit)

      unread,
      10:36 AM (5 hours ago) 10:36 AM
      to Achuith Bhandarkar, Chromium LUCI CQ, chromium...@chromium.org
      Gerrit-Comment-Date: Sat, 25 Jul 2026 14:35:55 +0000
      Gerrit-HasComments: No
      Gerrit-Has-Labels: Yes
      satisfied_requirement
      open
      diffy
      Reply all
      Reply to author
      Forward
      0 new messages