Reland "[macOS] Make modal sheet presentation asynchronous to prevent UAF bugs" [chromium/src : main]

0 views

Skip to first unread message

Bryan Oltman (Gerrit)

unread,

Jul 17, 2026, 9:43:43 AM (2 days ago) Jul 17

to Kalvin Lee, luci-bi...@appspot.gserviceaccount.com, Chromium LUCI CQ, Keren Zhu, Avi Drissman, rubber-...@appspot.gserviceaccount.com, android-bu...@system.gserviceaccount.com, chromium...@chromium.org

Attention needed from Avi Drissman, Kalvin Lee and Keren Zhu

Bryan Oltman has uploaded the change for review

Bryan Oltman would like Kalvin Lee, luci-bi...@appspot.gserviceaccount.com, Chromium LUCI CQ, Keren Zhu, Avi Drissman and rubber-...@appspot.gserviceaccount.com to review this change.

Commit message

Reland "[macOS] Make modal sheet presentation asynchronous to prevent UAF bugs"

This reverts commit 879c1fa69bbe9480b7aaaa1b8e4b16881642b266.

Reason for revert: Rolling forward with fixes

Original change's description:
> Revert "[macOS] Make modal sheet presentation asynchronous to prevent UAF bugs"
>
> This reverts commit 90309b0d2c7d8f975a2e3cc672d3e59b3e19947e.
>
> Reason for revert:
> LUCI Bisection has identified this change as the cause of a test failure. See the analysis: https://ci.chromium.org/ui/p/chromium/bisection/test-analysis/b/5250851556818944
>
> Sample build with failed test: https://ci.chromium.org/b/8676059972782943729
> Affected test(s):
> [://chrome/test\:browser_tests!gtest::BookmarkAccountStorageMoveDialogPixelTest#InvokeUi_ShowMoveBookmarkToAccount](https://ci.chromium.org/ui/test/chromium/:%2F%2Fchrome%2Ftest%5C:browser_tests%21gtest::BookmarkAccountStorageMoveDialogPixelTest%23InvokeUi_ShowMoveBookmarkToAccount?q=VHash%3A812306a38c719b85)
> [://chrome/test\:browser_tests!gtest::BookmarkAccountStorageMoveDialogPixelTest#InvokeUi_ShowMoveFolderToAccount](https://ci.chromium.org/ui/test/chromium/:%2F%2Fchrome%2Ftest%5C:browser_tests%21gtest::BookmarkAccountStorageMoveDialogPixelTest%23InvokeUi_ShowMoveFolderToAccount?q=VHash%3A812306a38c719b85)
> [://chrome/test\:browser_tests!gtest::ExtensionInstallBlockedByParentDialogTest#InvokeUi_app](https://ci.chromium.org/ui/test/chromium/:%2F%2Fchrome%2Ftest%5C:browser_tests%21gtest::ExtensionInstallBlockedByParentDialogTest%23InvokeUi_app?q=VHash%3A812306a38c719b85)
> [://chrome/test\:browser_tests!gtest::ExtensionInstallBlockedByParentDialogTest#InvokeUi_extension](https://ci.chromium.org/ui/test/chromium/:%2F%2Fchrome%2Ftest%5C:browser_tests%21gtest::ExtensionInstallBlockedByParentDialogTest%23InvokeUi_extension?q=VHash%3A812306a38c719b85)
> [://chrome/test\:browser_tests!gtest::SettingsOverriddenDialogBrowserTest#InvokeUi_SimpleDialog](https://ci.chromium.org/ui/test/chromium/:%2F%2Fchrome%2Ftest%5C:browser_tests%21gtest::SettingsOverriddenDialogBrowserTest%23InvokeUi_SimpleDialog?q=VHash%3A812306a38c719b85)
> and 14 more ...
>
> If this is a false positive, please report it at http://b.corp.google.com/createIssue?component=1199205&description=Analysis%3A+https%3A%2F%2Fci.chromium.org%2Fui%2Fp%2Fchromium%2Fbisection%2Ftest-analysis%2Fb%2F5250851556818944&format=PLAIN&priority=P3&title=Wrongly+blamed+https%3A%2F%2Fchromium-review.googlesource.com%2Fc%2Fchromium%2Fsrc%2F%2B%2F8086464&type=BUG
>
> Original change's description:
> > [macOS] Make modal sheet presentation asynchronous to prevent UAF bugs
> >
> > Modal sheet animations run a nested run loop synchronously in AppKit.
> > During this loop, the main thread remains active, allowing the parent or
> > child widget to be closed and its C++ bridge synchronously destroyed.
> > This leads to Use-After-Free (UAF) bugs when the nested loop exits and
> > execution resumes in the member functions of the deleted bridge.
> >
> > This CL runs modal sheet presentations asynchronously to prevent UAF:
> > - Always post the sheet animation task to the message loop (previously
> >   only done for remote cocoa).
> > - Add the SetVisibilityStateBridgeDestruction regression test.
> >
> > This CL also removes a weak pointer check in
> > FullscreenControllerTransitionComplete that is no longer necessary now
> > that the modal sheet presentation is asynchronous.
> >
> > Include-Ci-Only-Tests: true
> > Fixed: 518006007,502109333,502101200
> > Change-Id: I9a911b80d087f79920cbd944af854dbf82c6f6ae
> > Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8086464
> > Commit-Queue: Bryan Oltman <bryan...@google.com>
> > Reviewed-by: Keren Zhu <kere...@chromium.org>
> > Cr-Commit-Position: refs/heads/main@{#1663648}
> >
>
> No-Presubmit: true
> No-Tree-Checks: true
> No-Try: true
> Change-Id: I4604e56d435714b79d85c20029981319dd61c0e5
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8114268
> Owners-Override: Kalvin Lee <kd...@chromium.org>
> Commit-Queue: Kalvin Lee <kd...@chromium.org>
> Bot-Commit: rubber-...@appspot.gserviceaccount.com <rubber-...@appspot.gserviceaccount.com>
> Cr-Commit-Position: refs/heads/main@{#1663689}

Change-Id: I1ae6f9509f889b4b492c8ef4de0f27f90388913a

Change diff

Change information

Files:

M chrome/browser/ui/signin/signin_view_controller_interactive_uitest.cc
M chrome/browser/ui/views/relaunch_notification/relaunch_notification_controller_platform_impl_desktop_browsertest.cc
M chrome/browser/ui/views/web_dialog_view_interactive_uitest.cc
M components/remote_cocoa/app_shim/application_bridge.mm
M components/remote_cocoa/app_shim/native_widget_ns_window_bridge.mm
M components/remote_cocoa/app_shim/native_widget_ns_window_host_helper.h
M ui/views/cocoa/native_widget_mac_ns_window_host.h
M ui/views/cocoa/native_widget_mac_ns_window_host.mm
M ui/views/widget/native_widget_mac_unittest.mm
M ui/views/widget/widget_interactive_uitest.cc

Change size: M

Delta: 10 files changed, 105 insertions(+), 91 deletions(-)

Open in Gerrit

Related details

Attention is currently required from:

Avi Drissman
Kalvin Lee
Keren Zhu

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

rubber-stamper@appspot.gserviceaccount.com (Gerrit)

unread,

Jul 17, 2026, 9:44:22 AM (2 days ago) Jul 17

to Bryan Oltman, Kalvin Lee, luci-bi...@appspot.gserviceaccount.com, Chromium LUCI CQ, Keren Zhu, Avi Drissman, android-bu...@system.gserviceaccount.com, chromium...@chromium.org, grt+...@chromium.org, sky+...@chromium.org, roblia...@chromium.org, mac-r...@chromium.org

Attention needed from Avi Drissman, Kalvin Lee and Keren Zhu

rubber-...@appspot.gserviceaccount.com voted Bot-Commit+1

Bot-Commit

Open in Gerrit

Related details

Attention is currently required from:

Avi Drissman
Kalvin Lee
Keren Zhu

Submit Requirements:

Code-Coverage
Code-Owners

Code-Review
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Bryan Oltman (Gerrit)

unread,

Jul 18, 2026, 10:12:49 PM (9 hours ago) Jul 18

to Keren Zhu, Chromium LUCI CQ, android-bu...@system.gserviceaccount.com, chromium...@chromium.org, chromium-a...@chromium.org, extension...@chromium.org, grt+...@chromium.org, sky+...@chromium.org, roblia...@chromium.org, mac-r...@chromium.org

Attention needed from Keren Zhu

Bryan Oltman voted Commit-Queue+1

Commit-Queue

Open in Gerrit

Related details

Attention is currently required from:

Keren Zhu

Submit Requirements:

Code-Coverage
Code-Owners

Code-Review
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Reply all

Reply to author

Forward

0 new messages