Revert "[macOS] Make modal sheet presentation asynchronous to prevent UAF bugs" [chromium/src : main]

0 views
Skip to first unread message

luci-bisection@appspot.gserviceaccount.com (Gerrit)

unread,
Jul 17, 2026, 2:12:17 AM (2 days ago) Jul 17
to Chromium LUCI CQ, Keren Zhu, Avi Drissman, Bryan Oltman, android-bu...@system.gserviceaccount.com, chromium...@chromium.org
Attention needed from Avi Drissman, Bryan Oltman and Keren Zhu

luci-bi...@appspot.gserviceaccount.com has uploaded the change for review

luci-bi...@appspot.gserviceaccount.com would like Chromium LUCI CQ, Keren Zhu, Avi Drissman and Bryan Oltman to review this change.

Commit message

Revert "[macOS] Make modal sheet presentation asynchronous to prevent UAF bugs"

This reverts commit 90309b0d2c7d8f975a2e3cc672d3e59b3e19947e.

Reason for revert:
LUCI Bisection has identified this change as the cause of a test failure. See the analysis: https://ci.chromium.org/ui/p/chromium/bisection/test-analysis/b/5250851556818944

Sample build with failed test: https://ci.chromium.org/b/8676059972782943729
Affected test(s):
[://chrome/test\:browser_tests!gtest::BookmarkAccountStorageMoveDialogPixelTest#InvokeUi_ShowMoveBookmarkToAccount](https://ci.chromium.org/ui/test/chromium/:%2F%2Fchrome%2Ftest%5C:browser_tests%21gtest::BookmarkAccountStorageMoveDialogPixelTest%23InvokeUi_ShowMoveBookmarkToAccount?q=VHash%3A812306a38c719b85)
[://chrome/test\:browser_tests!gtest::BookmarkAccountStorageMoveDialogPixelTest#InvokeUi_ShowMoveFolderToAccount](https://ci.chromium.org/ui/test/chromium/:%2F%2Fchrome%2Ftest%5C:browser_tests%21gtest::BookmarkAccountStorageMoveDialogPixelTest%23InvokeUi_ShowMoveFolderToAccount?q=VHash%3A812306a38c719b85)
[://chrome/test\:browser_tests!gtest::ExtensionInstallBlockedByParentDialogTest#InvokeUi_app](https://ci.chromium.org/ui/test/chromium/:%2F%2Fchrome%2Ftest%5C:browser_tests%21gtest::ExtensionInstallBlockedByParentDialogTest%23InvokeUi_app?q=VHash%3A812306a38c719b85)
[://chrome/test\:browser_tests!gtest::ExtensionInstallBlockedByParentDialogTest#InvokeUi_extension](https://ci.chromium.org/ui/test/chromium/:%2F%2Fchrome%2Ftest%5C:browser_tests%21gtest::ExtensionInstallBlockedByParentDialogTest%23InvokeUi_extension?q=VHash%3A812306a38c719b85)
[://chrome/test\:browser_tests!gtest::SettingsOverriddenDialogBrowserTest#InvokeUi_SimpleDialog](https://ci.chromium.org/ui/test/chromium/:%2F%2Fchrome%2Ftest%5C:browser_tests%21gtest::SettingsOverriddenDialogBrowserTest%23InvokeUi_SimpleDialog?q=VHash%3A812306a38c719b85)
and 14 more ...

If this is a false positive, please report it at http://b.corp.google.com/createIssue?component=1199205&description=Analysis%3A+https%3A%2F%2Fci.chromium.org%2Fui%2Fp%2Fchromium%2Fbisection%2Ftest-analysis%2Fb%2F5250851556818944&format=PLAIN&priority=P3&title=Wrongly+blamed+https%3A%2F%2Fchromium-review.googlesource.com%2Fc%2Fchromium%2Fsrc%2F%2B%2F8086464&type=BUG

Original change's description:
> [macOS] Make modal sheet presentation asynchronous to prevent UAF bugs
>
> Modal sheet animations run a nested run loop synchronously in AppKit.
> During this loop, the main thread remains active, allowing the parent or
> child widget to be closed and its C++ bridge synchronously destroyed.
> This leads to Use-After-Free (UAF) bugs when the nested loop exits and
> execution resumes in the member functions of the deleted bridge.
>
> This CL runs modal sheet presentations asynchronously to prevent UAF:
> - Always post the sheet animation task to the message loop (previously
> only done for remote cocoa).
> - Add the SetVisibilityStateBridgeDestruction regression test.
>
> This CL also removes a weak pointer check in
> FullscreenControllerTransitionComplete that is no longer necessary now
> that the modal sheet presentation is asynchronous.
>
> Include-Ci-Only-Tests: true
> Fixed: 518006007,502109333,502101200
> Change-Id: I9a911b80d087f79920cbd944af854dbf82c6f6ae
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8086464
> Commit-Queue: Bryan Oltman <bryan...@google.com>
> Reviewed-by: Keren Zhu <kere...@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#1663648}
>
No-Presubmit: true
No-Tree-Checks: true
No-Try: true
Change-Id: I4604e56d435714b79d85c20029981319dd61c0e5

Change diff


Change information

Files:
  • M chrome/browser/ui/signin/signin_view_controller_interactive_uitest.cc
  • M chrome/browser/ui/views/relaunch_notification/relaunch_notification_controller_platform_impl_desktop_browsertest.cc
  • M chrome/browser/ui/views/web_dialog_view_interactive_uitest.cc
  • M components/remote_cocoa/app_shim/application_bridge.mm
  • M components/remote_cocoa/app_shim/native_widget_ns_window_bridge.mm
  • M components/remote_cocoa/app_shim/native_widget_ns_window_host_helper.h
  • M ui/views/cocoa/native_widget_mac_ns_window_host.h
  • M ui/views/cocoa/native_widget_mac_ns_window_host.mm
  • M ui/views/widget/native_widget_mac_unittest.mm
  • M ui/views/widget/widget_interactive_uitest.cc
Change size: M
Delta: 10 files changed, 91 insertions(+), 105 deletions(-)
Open in Gerrit

Related details

Attention is currently required from:
  • Avi Drissman
  • Bryan Oltman
  • Keren Zhu
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: newchange
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I4604e56d435714b79d85c20029981319dd61c0e5
Gerrit-Change-Number: 8114268
Gerrit-PatchSet: 1
Gerrit-Reviewer: Avi Drissman <a...@chromium.org>
Gerrit-Reviewer: Bryan Oltman <bryan...@google.com>
Gerrit-Reviewer: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>
Gerrit-Reviewer: Keren Zhu <kere...@chromium.org>
Gerrit-Attention: Keren Zhu <kere...@chromium.org>
Gerrit-Attention: Avi Drissman <a...@chromium.org>
Gerrit-Attention: Bryan Oltman <bryan...@google.com>
satisfied_requirement
unsatisfied_requirement
open
diffy

luci-bisection@appspot.gserviceaccount.com (Gerrit)

unread,
Jul 17, 2026, 2:12:42 AM (2 days ago) Jul 17
to rubber-...@appspot.gserviceaccount.com, Chromium LUCI CQ, Keren Zhu, Avi Drissman, Bryan Oltman, android-bu...@system.gserviceaccount.com, chromium...@chromium.org, kd...@google.com, grt+...@chromium.org, sky+...@chromium.org, roblia...@chromium.org, mac-r...@chromium.org
Attention needed from Avi Drissman, Bryan Oltman and Keren Zhu

Message from luci-bi...@appspot.gserviceaccount.com

LUCI Bisection could not automatically submit this revert because LUCI Bisection has not yet support auto-commit of revert CL for test failure.

Open in Gerrit

Related details

Attention is currently required from:
  • Avi Drissman
  • Bryan Oltman
  • Keren Zhu
Submit Requirements:
  • requirement satisfiedCode-Coverage
  • requirement is not satisfiedCode-Owners
  • requirement is not satisfiedCode-Review
  • requirement satisfiedReview-Enforcement
Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
Gerrit-MessageType: comment
Gerrit-Project: chromium/src
Gerrit-Branch: main
Gerrit-Change-Id: I4604e56d435714b79d85c20029981319dd61c0e5
Gerrit-Change-Number: 8114268
Gerrit-PatchSet: 1
Gerrit-Reviewer: Avi Drissman <a...@chromium.org>
Gerrit-Reviewer: Bryan Oltman <bryan...@google.com>
Gerrit-Reviewer: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>
Gerrit-Reviewer: Keren Zhu <kere...@chromium.org>
Gerrit-Attention: Keren Zhu <kere...@chromium.org>
Gerrit-Attention: Avi Drissman <a...@chromium.org>
Gerrit-Attention: Bryan Oltman <bryan...@google.com>
Gerrit-Comment-Date: Fri, 17 Jul 2026 06:12:28 +0000
Gerrit-HasComments: No
Gerrit-Has-Labels: No
satisfied_requirement
unsatisfied_requirement
open
diffy

rubber-stamper@appspot.gserviceaccount.com (Gerrit)

unread,
Jul 17, 2026, 2:13:20 AM (2 days ago) Jul 17
to luci-bi...@appspot.gserviceaccount.com, Chromium LUCI CQ, Keren Zhu, Avi Drissman, Bryan Oltman, android-bu...@system.gserviceaccount.com, chromium...@chromium.org, kd...@google.com, grt+...@chromium.org, sky+...@chromium.org, roblia...@chromium.org, mac-r...@chromium.org
Attention needed from Avi Drissman, Bryan Oltman and Keren Zhu

Related details

Attention is currently required from:
  • Avi Drissman
  • Bryan Oltman
  • Keren Zhu
Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement is not satisfiedCode-Owners
    • requirement satisfiedCode-Review
    • requirement satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I4604e56d435714b79d85c20029981319dd61c0e5
    Gerrit-Change-Number: 8114268
    Gerrit-PatchSet: 1
    Gerrit-Reviewer: Avi Drissman <a...@chromium.org>
    Gerrit-Reviewer: Bryan Oltman <bryan...@google.com>
    Gerrit-Reviewer: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>
    Gerrit-Reviewer: Keren Zhu <kere...@chromium.org>
    Gerrit-Attention: Keren Zhu <kere...@chromium.org>
    Gerrit-Attention: Avi Drissman <a...@chromium.org>
    Gerrit-Attention: Bryan Oltman <bryan...@google.com>
    Gerrit-Comment-Date: Fri, 17 Jul 2026 06:13:06 +0000
    Gerrit-HasComments: No
    Gerrit-Has-Labels: Yes
    satisfied_requirement
    unsatisfied_requirement
    open
    diffy

    Kalvin Lee (Gerrit)

    unread,
    Jul 17, 2026, 2:15:17 AM (2 days ago) Jul 17
    to luci-bi...@appspot.gserviceaccount.com, rubber-...@appspot.gserviceaccount.com, Chromium LUCI CQ, Keren Zhu, Avi Drissman, Bryan Oltman, android-bu...@system.gserviceaccount.com, chromium...@chromium.org, kd...@google.com, grt+...@chromium.org, sky+...@chromium.org, roblia...@chromium.org, mac-r...@chromium.org
    Attention needed from Avi Drissman, Bryan Oltman and Keren Zhu

    Kalvin Lee voted and added 1 comment

    Votes added by Kalvin Lee

    Commit-Queue+2
    Owners-Override+1

    1 comment

    Patchset-level comments
    File-level comment, Patchset 1 (Latest):
    Kalvin Lee . resolved

    APAC gardener casting owner-override.

    Open in Gerrit

    Related details

    Attention is currently required from:
    • Avi Drissman
    • Bryan Oltman
    • Keren Zhu
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement satisfiedCode-Review
    • requirement satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: comment
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I4604e56d435714b79d85c20029981319dd61c0e5
    Gerrit-Change-Number: 8114268
    Gerrit-PatchSet: 1
    Gerrit-Reviewer: Avi Drissman <a...@chromium.org>
    Gerrit-Reviewer: Bryan Oltman <bryan...@google.com>
    Gerrit-Reviewer: Chromium LUCI CQ <chromiu...@luci-project-accounts.iam.gserviceaccount.com>
    Gerrit-Reviewer: Kalvin Lee <kd...@chromium.org>
    Gerrit-Reviewer: Keren Zhu <kere...@chromium.org>
    Gerrit-Attention: Keren Zhu <kere...@chromium.org>
    Gerrit-Attention: Avi Drissman <a...@chromium.org>
    Gerrit-Attention: Bryan Oltman <bryan...@google.com>
    Gerrit-Comment-Date: Fri, 17 Jul 2026 06:14:55 +0000
    Gerrit-HasComments: Yes
    Gerrit-Has-Labels: Yes
    satisfied_requirement
    open
    diffy

    Chromium LUCI CQ (Gerrit)

    unread,
    Jul 17, 2026, 2:15:34 AM (2 days ago) Jul 17
    to luci-bi...@appspot.gserviceaccount.com, Kalvin Lee, rubber-...@appspot.gserviceaccount.com, Keren Zhu, Avi Drissman, Bryan Oltman, android-bu...@system.gserviceaccount.com, chromium...@chromium.org, kd...@google.com, grt+...@chromium.org, sky+...@chromium.org, roblia...@chromium.org, mac-r...@chromium.org

    Chromium LUCI CQ submitted the change

    Change information

    Owners-Override: Kalvin Lee <kd...@chromium.org>
    Commit-Queue: Kalvin Lee <kd...@chromium.org>
    Cr-Commit-Position: refs/heads/main@{#1663689}
    Files:
    • M chrome/browser/ui/signin/signin_view_controller_interactive_uitest.cc
    • M chrome/browser/ui/views/relaunch_notification/relaunch_notification_controller_platform_impl_desktop_browsertest.cc
    • M chrome/browser/ui/views/web_dialog_view_interactive_uitest.cc
    • M components/remote_cocoa/app_shim/application_bridge.mm
    • M components/remote_cocoa/app_shim/native_widget_ns_window_bridge.mm
    • M components/remote_cocoa/app_shim/native_widget_ns_window_host_helper.h
    • M ui/views/cocoa/native_widget_mac_ns_window_host.h
    • M ui/views/cocoa/native_widget_mac_ns_window_host.mm
    • M ui/views/widget/native_widget_mac_unittest.mm
    • M ui/views/widget/widget_interactive_uitest.cc
    Change size: M
    Delta: 10 files changed, 91 insertions(+), 105 deletions(-)
    Branch: refs/heads/main
    Submit Requirements:
    Open in Gerrit
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: merged
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I4604e56d435714b79d85c20029981319dd61c0e5
    Gerrit-Change-Number: 8114268
    Gerrit-PatchSet: 2
    open
    diffy
    satisfied_requirement

    Bryan Oltman (Gerrit)

    unread,
    Jul 17, 2026, 9:43:49 AM (2 days ago) Jul 17
    to luci-bi...@appspot.gserviceaccount.com, Chromium LUCI CQ, Kalvin Lee, rubber-...@appspot.gserviceaccount.com, Keren Zhu, Avi Drissman, android-bu...@system.gserviceaccount.com, chromium...@chromium.org, kd...@google.com, grt+...@chromium.org, sky+...@chromium.org, roblia...@chromium.org, mac-r...@chromium.org

    Bryan Oltman has created a revert of this change

    Related details

    Attention set is empty
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement satisfiedCode-Review
    • requirement satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: revert
    satisfied_requirement
    open
    diffy

    Bryan Oltman (Gerrit)

    unread,
    Jul 18, 2026, 10:12:41 PM (9 hours ago) Jul 18
    to luci-bi...@appspot.gserviceaccount.com, Chromium LUCI CQ, Keren Zhu, rubber-...@appspot.gserviceaccount.com, Kalvin Lee, android-bu...@system.gserviceaccount.com, chromium...@chromium.org, grt+...@chromium.org, sky+...@chromium.org, roblia...@chromium.org, mac-r...@chromium.org

    Bryan Oltman has created a revert of this change

    Related details

    Attention set is empty
    Submit Requirements:
    • requirement satisfiedCode-Coverage
    • requirement satisfiedCode-Owners
    • requirement satisfiedCode-Review
    • requirement satisfiedReview-Enforcement
    Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. DiffyGerrit
    Gerrit-MessageType: revert
    Gerrit-Project: chromium/src
    Gerrit-Branch: main
    Gerrit-Change-Id: I4604e56d435714b79d85c20029981319dd61c0e5
    Gerrit-Change-Number: 8114268
    Gerrit-PatchSet: 2
    Gerrit-CC: Kalvin Lee <kd...@chromium.org>
    Gerrit-CC: Keren Zhu <kere...@chromium.org>
    satisfied_requirement
    open
    diffy
    Reply all
    Reply to author
    Forward
    0 new messages