AbdAlRahman Gad (Gerrit)

unread,

Jul 25, 2025, 12:57:29 PMJul 25

to Chromium LUCI CQ, chromium...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

AbdAlRahman Gad added 1 comment

Patchset-level comments

File-level comment, Patchset 5 (Latest):

AbdAlRahman Gad . unresolved

Issue happens here:
```
#4 0x60dddfb4aa2a wl_cursor_theme_destroy
#5 0x60dddfab3621 ui::WaylandCursorFactory::ThemeData::~ThemeData()
#6 0x60dddfab6d35 std::__Cr::__tree<>::destroy()
#7 0x60dddfab3b5f ui::WaylandCursorFactory::~WaylandCursorFactory()
```

Full stack trace:
```
[DanglingSignature] base::debug::CollectStackTrace() No active task ui::WaylandCursor::~WaylandCursor() No active task

[DanglingPtr](1/3) A raw_ptr/raw_ref is dangling.

[DanglingPtr](2/3) First, the memory was freed at:

Stack trace:
#0 0x60dde996b742 base::debug::CollectStackTrace()
#1 0x60dde994f911 base::debug::StackTrace::StackTrace()
#2 0x60dde9974516 base::allocator::(anonymous namespace)::DanglingRawPtrDetected()
#3 0x60dde9a42e39 allocator_shim::internal::PartitionAllocFunctionsInternal<>::Free()
#4 0x60dddfb4aa2a wl_cursor_theme_destroy
#5 0x60dddfab3621 ui::WaylandCursorFactory::ThemeData::~ThemeData()
#6 0x60dddfab6d35 std::__Cr::__tree<>::destroy()
#7 0x60dddfab3b5f ui::WaylandCursorFactory::~WaylandCursorFactory()
#8 0x60dddfab3d9e ui::WaylandCursorFactory::~WaylandCursorFactory()
#9 0x60dddfb3bcd3 ui::(anonymous namespace)::OzonePlatformWayland::PostMainMessageLoopRun()
#10 0x60dde3e2fc87 content::BrowserMainLoop::ShutdownThreadsAndCleanUp()
#11 0x60dde3e32b00 content::BrowserMainRunnerImpl::Shutdown()
#12 0x60dde3e2bc7f content::BrowserMain()
#13 0x60dde6971452 content::RunBrowserProcessMain()
#14 0x60dde6973d3a content::ContentMainRunnerImpl::RunBrowser()
#15 0x60dde6973534 content::ContentMainRunnerImpl::Run()
#16 0x60dde696fee9 content::RunContentProcess()
#17 0x60dde6970054 content::ContentMain()
#18 0x60dde8bf27c7 content::BrowserTestBase::SetUp()
#19 0x60dde77b52cf InProcessBrowserTest::SetUp()
#20 0x60dde6f1a907 testing::Test::Run()
#21 0x60dde6f1b6c2 testing::TestInfo::Run()
#22 0x60dde6f1c157 testing::TestSuite::Run()
#23 0x60dde6f29ad7 testing::internal::UnitTestImpl::RunAllTests()
#24 0x60dde6f292cf testing::UnitTest::Run()
#25 0x60ddf37bd57a base::TestSuite::Run()
#26 0x60dde777f93b ChromeTestSuiteRunner::RunTestSuiteInternal()
#27 0x60ddde21fd5c InteractiveUITestSuiteRunner::RunTestSuite()
#28 0x60dde777fc5f ChromeTestLauncherDelegate::RunTestSuite()
#29 0x60dde8c53525 content::LaunchTestsInternal()
#30 0x60dde8c53b25 content::LaunchTests()
#31 0x60dde777ff2b LaunchChromeTests()
#32 0x60ddde21fcc7 main
#33 0x75e5f722a1ca (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9)
#34 0x75e5f722a28b __libc_start_main
#35 0x60ddddebf02a _start

[DanglingPtr](3/3) Later, the dangling raw_ptr was released at:

Stack trace:
#0 0x60dde996b742 base::debug::CollectStackTrace()
#1 0x60dde994f911 base::debug::StackTrace::StackTrace()
#2 0x60dde99745fd base::allocator::(anonymous namespace)::DanglingRawPtrReleased<>()
#3 0x60dde99bf14f base::internal::RawPtrBackupRefImpl<>::ReleaseInternal()
#4 0x60dddfab10e5 ui::WaylandCursor::~WaylandCursor()
#5 0x60dddfaacab7 ui::WaylandConnection::~WaylandConnection()
#6 0x60dddfb3bcec ui::(anonymous namespace)::OzonePlatformWayland::PostMainMessageLoopRun()
#7 0x60dde3e2fc87 content::BrowserMainLoop::ShutdownThreadsAndCleanUp()
#8 0x60dde3e32b00 content::BrowserMainRunnerImpl::Shutdown()
#9 0x60dde3e2bc7f content::BrowserMain()
#10 0x60dde6971452 content::RunBrowserProcessMain()
#11 0x60dde6973d3a content::ContentMainRunnerImpl::RunBrowser()
#12 0x60dde6973534 content::ContentMainRunnerImpl::Run()
#13 0x60dde696fee9 content::RunContentProcess()
#14 0x60dde6970054 content::ContentMain()
#15 0x60dde8bf27c7 content::BrowserTestBase::SetUp()
#16 0x60dde77b52cf InProcessBrowserTest::SetUp()
#17 0x60dde6f1a907 testing::Test::Run()
#18 0x60dde6f1b6c2 testing::TestInfo::Run()
#19 0x60dde6f1c157 testing::TestSuite::Run()
#20 0x60dde6f29ad7 testing::internal::UnitTestImpl::RunAllTests()
#21 0x60dde6f292cf testing::UnitTest::Run()
#22 0x60ddf37bd57a base::TestSuite::Run()
#23 0x60dde777f93b ChromeTestSuiteRunner::RunTestSuiteInternal()
#24 0x60ddde21fd5c InteractiveUITestSuiteRunner::RunTestSuite()
#25 0x60dde777fc5f ChromeTestLauncherDelegate::RunTestSuite()
#26 0x60dde8c53525 content::LaunchTestsInternal()
#27 0x60dde8c53b25 content::LaunchTests()
#28 0x60dde777ff2b LaunchChromeTests()
#29 0x60ddde21fcc7 main
#30 0x75e5f722a1ca (/usr/lib/x86_64-linux-gnu/libc.so.6+0x2a1c9)
#31 0x75e5f722a28b __libc_start_main
#32 0x60ddddebf02a _start

Please check for more information on:
https://chromium.googlesource.com/chromium/src/+/main/docs/dangling_ptr_guide.md
```

Open in Gerrit

Related details

Attention set is empty

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

AbdAlRahman Gad (Gerrit)

unread,

Jul 25, 2025, 3:46:33 PMJul 25

to Chromium LUCI CQ, chromium...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Patchset-level comments

AbdAlRahman Gad

There is a merge conflict which I'll address after your reply!

Open in Gerrit

Related details

Attention set is empty

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Max Ihlenfeldt (Gerrit)

unread,

Jul 28, 2025, 5:46:21 AMJul 28

to AbdAlRahman Gad, Chromium LUCI CQ, chromium...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from AbdAlRahman Gad

Max Ihlenfeldt added 2 comments

File ui/ozone/platform/wayland/host/wayland_cursor_factory.cc

Line 45, Patchset 5 (Latest): cursor.reset();

Max Ihlenfeldt . unresolved

Why does this fix the error? From the stack trace it looks like `WaylandCursor` has a dangling pointer:

```

the dangling raw_ptr was released at:

...

#4 0x60dddfab10e5 ui::WaylandCursor::~WaylandCursor()

```

File ui/ozone/platform/wayland/ozone_platform_wayland.cc

Line 492, Patchset 5 (Latest): !PA_BUILDFLAG(ENABLE_DANGLING_RAW_PTR_CHECKS)

Max Ihlenfeldt . unresolved

We should be able to remove this `#if` completely, as there are no other platforms where ozone/wayland is used (in fact it's Linux-only nowadays).

Open in Gerrit

Related details

Attention is currently required from:

AbdAlRahman Gad

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Max Ihlenfeldt (Gerrit)

unread,

Jul 28, 2025, 12:54:58 PMJul 28

to AbdAlRahman Gad, Chromium LUCI CQ, chromium...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from AbdAlRahman Gad

Max Ihlenfeldt added 1 comment

Patchset-level comments

File-level comment, Patchset 5:

AbdAlRahman Gad . unresolved

#4 0x60dddfab10e5 ui::WaylandCursor::~WaylandCursor()

Max Ihlenfeldt

Can you check if adding a `connection_->UpdateCursor()` call in `~WaylandCursorFactory()` fixes the issue? That should reset `WaylandPointer`, [which holds the problematic `raw_ptr`](https://source.chromium.org/chromium/chromium/src/+/main:ui/ozone/platform/wayland/host/wayland_cursor.h;l=101;drc=f59abac1eba001fd2cec58035a36d5cbc9e69773).

Open in Gerrit

Related details

Attention is currently required from:

AbdAlRahman Gad

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

AbdAlRahman Gad (Gerrit)

unread,

Jul 29, 2025, 2:14:55 AMJul 29

to Chromium LUCI CQ, chromium...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from Max Ihlenfeldt

AbdAlRahman Gad added 3 comments

Patchset-level comments

File-level comment, Patchset 5:

AbdAlRahman Gad

Looks like the tests now time out.

File ui/ozone/platform/wayland/host/wayland_cursor_factory.cc

Line 45, Patchset 5: cursor.reset();

Max Ihlenfeldt . resolved

Why does this fix the error? From the stack trace it looks like `WaylandCursor` has a dangling pointer:

```

the dangling raw_ptr was released at:

...

#4 0x60dddfab10e5 ui::WaylandCursor::~WaylandCursor()

```

AbdAlRahman Gad

Acknowledged

File ui/ozone/platform/wayland/ozone_platform_wayland.cc

Line 492, Patchset 5: !PA_BUILDFLAG(ENABLE_DANGLING_RAW_PTR_CHECKS)

Max Ihlenfeldt . resolved

We should be able to remove this `#if` completely, as there are no other platforms where ozone/wayland is used (in fact it's Linux-only nowadays).

AbdAlRahman Gad

Done

Open in Gerrit

Related details

Attention is currently required from:

Max Ihlenfeldt

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Max Ihlenfeldt (Gerrit)

unread,

Jul 29, 2025, 5:59:30 AMJul 29

to AbdAlRahman Gad, Chromium LUCI CQ, chromium...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from AbdAlRahman Gad

Max Ihlenfeldt added 1 comment

Patchset-level comments

File-level comment, Patchset 5:

Max Ihlenfeldt

Looks like there's one more dangling pointer. e.g. from https://chromium-swarm.appspot.com/task?id=726beaa416e0bb10:

```

[DanglingPtr](2/3) First, the memory was freed at:

Stack trace:
#0 0x5e968f61f142 base::debug::CollectStackTrace()
#1 0x5e968f6030a1 base::debug::StackTrace::StackTrace()
#2 0x5e968f627d36 base::allocator::(anonymous namespace)::DanglingRawPtrDetected()
#3 0x5e96916523bd allocator_shim::internal::PartitionAllocFunctionsInternal<>::Free()
#4 0x5e968bba4847 content::BrowserMainLoop::ShutdownThreadsAndCleanUp()
#5 0x5e968bba75b0 content::BrowserMainRunnerImpl::Shutdown()
...

[DanglingPtr](3/3) Later, the dangling raw_ptr was released at:

Stack trace:
#0 0x5e968f61f142 base::debug::CollectStackTrace()
#1 0x5e968f6030a1 base::debug::StackTrace::StackTrace()
#2 0x5e968f627e1d base::allocator::(anonymous namespace)::DanglingRawPtrReleased<>()
#3 0x5e96915ce5cf base::internal::RawPtrBackupRefImpl<>::ReleaseInternal()
#4 0x5e968787310e ui::WaylandScreen::~WaylandScreen()
#5 0x5e968787327e ui::WaylandScreen::~WaylandScreen()
#6 0x5e9693bb7de8 aura::ScreenOzone::~ScreenOzone()
#7 0x5e9691572bbe views::DesktopScreenOzone::~DesktopScreenOzone()
#8 0x5e969b48bd1b ChromeBrowserMainExtraPartsViews::~ChromeBrowserMainExtraPartsViews()
#9 0x5e969b48b9d0 ChromeBrowserMainExtraPartsViewsLinux::~ChromeBrowserMainExtraPartsViewsLinux()
#10 0x5e968f6f192c ChromeBrowserMainParts::~ChromeBrowserMainParts()
#11 0x5e968fcc1e8e ChromeBrowserMainPartsLinux::~ChromeBrowserMainPartsLinux()
#12 0x5e968bba0edf content::BrowserMainLoop::~BrowserMainLoop()
#13 0x5e968bba10fe content::BrowserMainLoop::~BrowserMainLoop()
#14 0x5e968bba75cc content::BrowserMainRunnerImpl::Shutdown()
...
```

[`WaylandScreen` has only one `raw_ptr`.](https://source.chromium.org/chromium/chromium/src/+/main:ui/ozone/platform/wayland/host/wayland_screen.h;l=123;drc=6434d1564cdc9cff6dcfa4db9c5e2ac9d525e4a8) Can you please take a look?

Open in Gerrit

Related details

Attention is currently required from:

AbdAlRahman Gad

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

AbdAlRahman Gad (Gerrit)

unread,

Jul 30, 2025, 1:03:11 AMJul 30

to Chromium LUCI CQ, chromium...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from AbdAlRahman Gad and Max Ihlenfeldt

AbdAlRahman Gad voted and added 1 comment

Votes added by AbdAlRahman Gad

Commit-Queue

+1

1 comment

Patchset-level comments

File-level comment, Patchset 5:

AbdAlRahman Gad

There is still dangling pointer here:
```

[DanglingPtr](2/3) First, the memory was freed at:

Stack trace:
#0 0x5fd28ea8f0e2 base::debug::CollectStackTrace()
#1 0x5fd28ea73041 base::debug::StackTrace::StackTrace()
#2 0x5fd28ea97cd6 base::allocator::(anonymous namespace)::DanglingRawPtrDetected()
#3 0x5fd290b129ed allocator_shim::internal::PartitionAllocFunctionsInternal<>::Free()
#4 0x5fd281924451 base::OnceCallback<>::Run()
#5 0x5fd28e9c784d base::TaskAnnotator::RunTaskImpl()
#6 0x5fd28ea196ab base::internal::TaskTracker::RunTaskImpl()
#7 0x5fd28ea19791 base::internal::TaskTracker::RunBlockShutdown()
#8 0x5fd28ea18d92 base::internal::TaskTracker::RunTask()
#9 0x5fd28ea1869e base::internal::TaskTracker::RunAndPopNextTask()
#10 0x5fd28ea3a9f7 base::internal::WorkerThread::RunWorker()
#11 0x5fd28ea3a53d base::internal::WorkerThread::RunPooledWorker()
#12 0x5fd28ea3a435 base::internal::WorkerThread::ThreadMain()
#13 0x5fd28ea675e3 base::(anonymous namespace)::ThreadFunc()
#14 0x7b211489caa4 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x9caa3)
#15 0x7b2114929a34 __clone

Task trace:
#0 0x5fd287dfaf09 network::TrustTokenDatabaseOwner::~TrustTokenDatabaseOwner()

[DanglingPtr](3/3) Later, the dangling raw_ptr was released at:

Stack trace:
#0 0x5fd28ea8f0e2 base::debug::CollectStackTrace()
#1 0x5fd28ea73041 base::debug::StackTrace::StackTrace()
#2 0x5fd28ea97dbd base::allocator::(anonymous namespace)::DanglingRawPtrReleased<>()
#3 0x5fd290a8ebff base::internal::RawPtrBackupRefImpl<>::ReleaseInternal()
#4 0x5fd2913d58d2 sqlite_proto::TableManager::~TableManager()
#5 0x5fd2913d471a sqlite_proto::ProtoTableManager::~ProtoTableManager()
#6 0x5fd287dfb04e network::TrustTokenDatabaseOwner::~TrustTokenDatabaseOwner()
#7 0x5fd287df28ed network::SQLiteTrustTokenPersister::~SQLiteTrustTokenPersister()
#8 0x5fd287e138e1 network::TrustTokenStore::~TrustTokenStore()
#9 0x5fd287df0eda network::PendingTrustTokenStore::~PendingTrustTokenStore()
#10 0x5fd292c79884 network::NetworkContext::~NetworkContext()
#11 0x5fd292c79c5e network::NetworkContext::~NetworkContext()
#12 0x5fd292cb8540 network::NetworkService::OnNetworkContextConnectionClosed()
#13 0x5fd292c85669 base::OnceCallback<>::Run()
#14 0x5fd281924451 base::OnceCallback<>::Run()
#15 0x5fd2914d236a mojo::InterfaceEndpointClient::NotifyError()
#16 0x5fd2914e1d83 mojo::internal::MultiplexRouter::ProcessNotifyErrorTask()
#17 0x5fd2914de6d6 mojo::internal::MultiplexRouter::ProcessTasks()
#18 0x5fd2914dcdba mojo::internal::MultiplexRouter::OnPipeConnectionError()
#19 0x5fd281924451 base::OnceCallback<>::Run()
#20 0x5fd2914cae92 mojo::Connector::HandleError()
#21 0x5fd2914cb8d7 mojo::Connector::OnWatcherHandleReady()
#22 0x5fd28593e469 base::RepeatingCallback<>::Run()
#23 0x5fd28c8f6ba3 base::RepeatingCallback<>::Run()
#24 0x5fd28ff74d64 mojo::SimpleWatcher::OnHandleReady()
#25 0x5fd28ff74f3d mojo::SimpleWatcher::Context::Notify()
#26 0x5fd28ff73f50 mojo::SimpleWatcher::Context::CallNotify()
#27 0x5fd2868a8850 mojo::core::ipcz_driver::MojoTrap::DispatchEvent()
#28 0x5fd2868a777a mojo::core::ipcz_driver::MojoTrap::DispatchOrQueueEvent()
#29 0x5fd2868a85c1 mojo::core::ipcz_driver::MojoTrap::HandleEvent()
#30 0x5fd2868a80e3 mojo::core::ipcz_driver::MojoTrap::TrapEventHandler()
#31 0x5fd2868ee026 ipcz::TrapEventDispatcher::~TrapEventDispatcher()
#32 0x5fd2868e348d ipcz::Router::AcceptRouteClosureFrom()
#33 0x5fd2868d431b ipcz::NodeLink::OnRouteClosed()
#34 0x5fd2868dc46b ipcz::msg::NodeMessageListener::OnTransportMessage()
#35 0x5fd2868bfe7d ipcz::(anonymous namespace)::NotifyTransport()
#36 0x5fd2868af2a9 mojo::core::ipcz_driver::Transport::OnChannelMessage()
#37 0x5fd2868994bc mojo::core::Channel::TryDispatchMessage()
#38 0x5fd286898bbd mojo::core::Channel::OnReadComplete()
#39 0x5fd2868b3a4c mojo::core::ChannelPosix::OnFdReadable()
#40 0x5fd28e9467d4 base::(anonymous namespace)::MessagePumpForIOFdWatchImpl::OnFileCanReadWithoutBlocking()
#41 0x5fd28eaa79b8 base::MessagePumpEpoll::FdWatchController::OnFdReadable()
#42 0x5fd28eaa6fc2 base::MessagePumpEpoll::HandleEvent()
#43 0x5fd28eaa64e5 base::MessagePumpEpoll::OnEpollEvent()
#44 0x5fd28eaa564e base::MessagePumpEpoll::WaitForEpollEvents()
#45 0x5fd28eaa4d28 base::MessagePumpEpoll::Run()
#46 0x5fd28ea0707a base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run()
#47 0x5fd28e9953d6 base::RunLoop::Run()
#48 0x5fd28ea472f6 base::Thread::Run()
#49 0x5fd294199efa content::(anonymous namespace)::ChildIOThread::Run()
#50 0x5fd28ea4770c base::Thread::ThreadMain()
#51 0x5fd28ea675e3 base::(anonymous namespace)::ThreadFunc()
#52 0x7b211489caa4 (/usr/lib/x86_64-linux-gnu/libc.so.6+0x9caa3)
#53 0x7b2114929a34 __clone
```

Open in Gerrit

Related details

Attention is currently required from:

AbdAlRahman Gad
Max Ihlenfeldt

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Max Ihlenfeldt (Gerrit)

unread,

Jul 30, 2025, 4:23:22 AMJul 30

to AbdAlRahman Gad, Chromium LUCI CQ, chromium...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from AbdAlRahman Gad

Max Ihlenfeldt added 1 comment

Patchset-level comments

File-level comment, Patchset 5:

Max Ihlenfeldt

Can you try moving [this line with `backing_database_`](https://source.chromium.org/chromium/chromium/src/+/main:services/network/trust_tokens/trust_token_database_owner.h;l=100;drc=2e85357a8b76996981cc6f783853a49df2cedc3a) to be above `table_manager_`? Not sure why this only comes up now.

Open in Gerrit

Related details

Attention is currently required from:

AbdAlRahman Gad

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

AbdAlRahman Gad (Gerrit)

unread,

Jul 30, 2025, 11:16:18 AMJul 30

to AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from Max Ihlenfeldt

AbdAlRahman Gad added 1 comment

Patchset-level comments

File-level comment, Patchset 5:

AbdAlRahman Gad

It does not compile.

Open in Gerrit

Related details

Attention is currently required from:

Max Ihlenfeldt

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Max Ihlenfeldt (Gerrit)

unread,

Jul 31, 2025, 4:26:49 AMJul 31

to AbdAlRahman Gad, AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from AbdAlRahman Gad

Max Ihlenfeldt added 1 comment

Patchset-level comments

File-level comment, Patchset 5:

Max Ihlenfeldt

Ah, you'll have to move [the initialization of `backing_database_` in the ctor](https://source.chromium.org/chromium/chromium/src/+/main:services/network/trust_tokens/trust_token_database_owner.cc;l=92-99;drc=f6d32735e79eaa8c99e5e1ecee1b44affc52a119) up to be above the initialization of `table_manager_` as well.

Open in Gerrit

Related details

Attention is currently required from:

AbdAlRahman Gad

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

AbdAlRahman Gad (Gerrit)

unread,

Aug 1, 2025, 6:30:32 PMAug 1

to AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from Max Ihlenfeldt

AbdAlRahman Gad added 1 comment

Patchset-level comments

File-level comment, Patchset 5:

AbdAlRahman Gad

We now get different kind of errors.

Open in Gerrit

Related details

Attention is currently required from:

Max Ihlenfeldt

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Max Ihlenfeldt (Gerrit)

unread,

Aug 4, 2025, 5:10:24 AMAug 4

to AbdAlRahman Gad, AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from AbdAlRahman Gad

Max Ihlenfeldt added 1 comment

Patchset-level comments

File-level comment, Patchset 5:

Max Ihlenfeldt

I don't think the errors on the Mac bot are related to your change, they'll probably go away after a re-run.

For the Wayland errors, please do a local build with `enable_backup_ref_ptr_instance_tracer=true` set in `args.gn` and run one of the failing tests. That should give more insight into where the dangling pointer is.

Open in Gerrit

Related details

Attention is currently required from:

AbdAlRahman Gad

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

AbdAlRahman Gad (Gerrit)

unread,

Aug 12, 2025, 6:50:00 PMAug 12

to AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from Max Ihlenfeldt

AbdAlRahman Gad added 1 comment

Patchset-level comments

File-level comment, Patchset 5:

AbdAlRahman Gad

Kindly check the latest patch and the failing tests as I think I am now stuck.

Open in Gerrit

Related details

Attention is currently required from:

Max Ihlenfeldt

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Max Ihlenfeldt (Gerrit)

unread,

Aug 14, 2025, 6:16:56 AMAug 14

to AbdAlRahman Gad, AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from AbdAlRahman Gad

Max Ihlenfeldt added 1 comment

Patchset-level comments

File-level comment, Patchset 5:

Max Ihlenfeldt

The problem seems to be that `ChromeBrowserMainExtraPartsViews` keeps its screen (which on Wayland holds a pointer to `WaylandConnection`) around until it's destroyed, but we reset the connection in `OzonePlatformWayland::PostMainMessageLoopRun()` already.

Can you try adding `screen_.reset()` in [ChromeBrowserMainExtraPartsViews::PostMainMessageLoopRun()](https://source.chromium.org/chromium/chromium/src/+/main:chrome/browser/ui/views/chrome_browser_main_extra_parts_views.cc;l=177;drc=98344435860d41977208fb875298162993ea091f)?

Open in Gerrit

Related details

Attention is currently required from:

AbdAlRahman Gad

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

AbdAlRahman Gad (Gerrit)

unread,

Aug 16, 2025, 12:44:55 PMAug 16

to AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from Max Ihlenfeldt

AbdAlRahman Gad added 1 comment

Patchset-level comments

File-level comment, Patchset 5:

AbdAlRahman Gad

It looks like it doesn’t work yet.

Also, could you please tell me how you came up with this analysis? I want to learn more.

Open in Gerrit

Related details

Attention is currently required from:

Max Ihlenfeldt

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Max Ihlenfeldt (Gerrit)

unread,

Aug 18, 2025, 5:07:01 AMAug 18

to AbdAlRahman Gad, AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from AbdAlRahman Gad

Max Ihlenfeldt added 1 comment

Patchset-level comments

File-level comment, Patchset 5:

Max Ihlenfeldt

Hm, I'd feared it wouldn't be this easy.

I looked at the error message, e.g. taken from [here](https://chromium-swarm.appspot.com/task?id=72a0125c9de9ac10):

```

[DanglingPtr](2/3) First, the memory was freed at:

Stack trace:
#0 0x557da866f882 base::debug::CollectStackTrace()
#1 0x557da86537c1 base::debug::StackTrace::StackTrace()
#2 0x557da8678476 base::allocator::(anonymous namespace)::DanglingRawPtrDetected()
#3 0x557daa712919 allocator_shim::internal::PartitionAllocFunctionsInternal<>::Free()
#4 0x557da4b5d797 content::BrowserMainLoop::ShutdownThreadsAndCleanUp()
#5 0x557da4b60500 content::BrowserMainRunnerImpl::Shutdown()
...

[DanglingPtr](3/3) Later, the dangling raw_ptr was released at:

Stack trace:
#0 0x557da866f882 base::debug::CollectStackTrace()
#1 0x557da86537c1 base::debug::StackTrace::StackTrace()
#2 0x557da867855d base::allocator::(anonymous namespace)::DanglingRawPtrReleased<>()
#3 0x557daa68c78f base::internal::RawPtrBackupRefImpl<>::ReleaseInternal()
#4 0x557da07b2a7e ui::WaylandScreen::~WaylandScreen()
#5 0x557da07b2bee ui::WaylandScreen::~WaylandScreen()
#6 0x557dacc8fe18 aura::ScreenOzone::~ScreenOzone()
#7 0x557daa630dbe views::DesktopScreenOzone::~DesktopScreenOzone()
#8 0x557db45169cb ChromeBrowserMainExtraPartsViews::~ChromeBrowserMainExtraPartsViews()
#9 0x557db4516680 ChromeBrowserMainExtraPartsViewsLinux::~ChromeBrowserMainExtraPartsViewsLinux()
#10 0x557da87422fc ChromeBrowserMainParts::~ChromeBrowserMainParts()
#11 0x557da8d194fe ChromeBrowserMainPartsLinux::~ChromeBrowserMainPartsLinux()
#12 0x557da4b59e2f content::BrowserMainLoop::~BrowserMainLoop()
#13 0x557da4b5a04e content::BrowserMainLoop::~BrowserMainLoop()
#14 0x557da4b6051c content::BrowserMainRunnerImpl::Shutdown()
...
```

Even though the stack trace for where the memory was freed isn't too helpful, the trace for where the dangling pointer was released is. We can see that the dangling pointer is freed as part of `ui::WaylandScreen::~WaylandScreen()`, and the only `raw_ptr` member of that class is its `WaylandConnection` pointer. If we go back up the stack trace we traverse the class hierarchy (`WaylandScreen`, `ScreenOzone`, `DesktopScreenOzone`), and the first non-screen dtor is `~ChromeBrowserMainExtraPartsViews()`, which is the class owning the screen. That's why I suggested trying to reset that, and because we reset the connection in `OzonePlatformWayland::PostMainMessageLoopRun()` I thought that `ChromeBrowserMainExtraPartsViews::PostMainMessageLoopRun()` might be a good place to reset the screen.

But as we can see it's not a good place to reset the screen. We could add some kind of shutdown / clear platform state method to `display::Screen`, but the fact that that doesn't seem to exist yet makes me think we might not want to do it.

What could work instead is adding something like a `ResetConnection()` method to `WaylandScreen`, and then in `~WaylandConnection` we add this:
```
if (wayland_output_manager() && wayland_output_manager()->wayland)screen()) {
  wayland_output_manager()->wayland_screen()->ResetConnection();
}
```

Open in Gerrit

Related details

Attention is currently required from:

AbdAlRahman Gad

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

AbdAlRahman Gad (Gerrit)

unread,

Aug 26, 2025, 6:28:06 AM (13 days ago) Aug 26

to AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from Max Ihlenfeldt

AbdAlRahman Gad added 1 comment

Patchset-level comments

File-level comment, Patchset 5:

AbdAlRahman Gad . resolved

AbdAlRahman Gad

Done

Open in Gerrit

Related details

Attention is currently required from:

Max Ihlenfeldt

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Max Ihlenfeldt (Gerrit)

unread,

Aug 26, 2025, 6:53:57 AM (13 days ago) Aug 26

to AbdAlRahman Gad, Charlie Harrison, AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from AbdAlRahman Gad and Charlie Harrison

Max Ihlenfeldt voted and added 2 comments

Votes added by Max Ihlenfeldt

Code-Review

+1

2 comments

Patchset-level comments

File-level comment, Patchset 21 (Latest):

Max Ihlenfeldt . resolved

lgtm % nits!

Charlie, could you PTAL at the `//services/network/trust_tokens` changes? We had to move some things around to avoid dangling pointers due to destruction order.

File ui/ozone/platform/wayland/host/wayland_connection.h

Line 20, Patchset 21 (Latest):#include "ui/ozone/platform/wayland/host/wayland_cursor_factory.h"

Max Ihlenfeldt . unresolved

nit: I think we don't actually need this include just to declare `WaylandCursorFactory` as a friend, please remove it.

Open in Gerrit

Related details

Attention is currently required from:

AbdAlRahman Gad
Charlie Harrison

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review

No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

AbdAlRahman Gad (Gerrit)

unread,

Aug 26, 2025, 7:49:30 AM (13 days ago) Aug 26

to Charlie Harrison, AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from Charlie Harrison and Max Ihlenfeldt

AbdAlRahman Gad added 1 comment

File ui/ozone/platform/wayland/host/wayland_connection.h

Line 20, Patchset 21:#include "ui/ozone/platform/wayland/host/wayland_cursor_factory.h"

Max Ihlenfeldt . resolved

nit: I think we don't actually need this include just to declare `WaylandCursorFactory` as a friend, please remove it.

AbdAlRahman Gad

Done

Open in Gerrit

Related details

Attention is currently required from:

Charlie Harrison
Max Ihlenfeldt

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Max Ihlenfeldt (Gerrit)

unread,

Aug 26, 2025, 9:12:37 AM (13 days ago) Aug 26

to AbdAlRahman Gad, Charlie Harrison, AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from AbdAlRahman Gad and Charlie Harrison

Max Ihlenfeldt voted and added 1 comment

Votes added by Max Ihlenfeldt

Code-Review

+1

1 comment

Patchset-level comments

File-level comment, Patchset 22 (Latest):

Max Ihlenfeldt . resolved

still lgtm

Open in Gerrit

Related details

Attention is currently required from:

AbdAlRahman Gad
Charlie Harrison

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Charlie Harrison (Gerrit)

unread,

Aug 26, 2025, 10:26:38 AM (13 days ago) Aug 26

to AbdAlRahman Gad, AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from AbdAlRahman Gad

Charlie Harrison added 1 comment

Commit Message

Line 7, Patchset 22 (Latest):Enable connection/cursor cleanup on Linux

Charlie Harrison . unresolved

Can you please write a bit more in the commit message? I don't know what this CL is trying to accomplish. Can you include in the description why TT needs to be updated? I think it is because:

1. TableManager holds a raw ptr to the sql::Database
2. With the current CL, TableManager is freed after the Database is freed

Open in Gerrit

Related details

Attention is currently required from:

AbdAlRahman Gad

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review

No-Unresolved-Comments

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

AbdAlRahman Gad (Gerrit)

unread,

Aug 27, 2025, 1:10:57 AM (12 days ago) Aug 27

to Charlie Harrison, AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from Charlie Harrison

AbdAlRahman Gad added 1 comment

Commit Message

Line 7, Patchset 22:Enable connection/cursor cleanup on Linux

Charlie Harrison . resolved

Can you please write a bit more in the commit message? I don't know what this CL is trying to accomplish. Can you include in the description why TT needs to be updated? I think it is because:
1. TableManager holds a raw ptr to the sql::Database
2. With the current CL, TableManager is freed after the Database is freed

AbdAlRahman Gad

Done

Open in Gerrit

Related details

Attention is currently required from:

Charlie Harrison

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Charlie Harrison (Gerrit)

unread,

Aug 27, 2025, 10:02:52 AM (12 days ago) Aug 27

to AbdAlRahman Gad, AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Attention needed from AbdAlRahman Gad

Charlie Harrison voted Code-Review+1

Code-Review

+1

Open in Gerrit

Related details

Attention is currently required from:

AbdAlRahman Gad

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

open

diffy

AbdAlRahman Gad (Gerrit)

unread,

Aug 27, 2025, 7:08:01 PM (11 days ago) Aug 27

to Charlie Harrison, AyeAye, Chromium LUCI CQ, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

AbdAlRahman Gad voted Commit-Queue+2

Commit-Queue

+2

Open in Gerrit

Related details

Attention set is empty

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

open

diffy

Chromium LUCI CQ (Gerrit)

unread,

Aug 27, 2025, 8:56:48 PM (11 days ago) Aug 27

to AbdAlRahman Gad, Charlie Harrison, AyeAye, chromium...@chromium.org, network-ser...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org

Chromium LUCI CQ submitted the change

Change information

Commit message:

Enable connection/cursor cleanup on Linux

- Fix the dangling pointers that were caused by the change.
- TableManager holds a raw pointer to sql::Database, but with the current CL, the Database is freed before the TableManager, preventing a potential dangling pointer.

Bug: 324294360

Change-Id: I06855685f53ab87dfe873a2e237914923a641bb0

Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6768832

Reviewed-by: Charlie Harrison <cshar...@chromium.org>

Commit-Queue: AbdAlRahman Gad <ag...@igalia.com>

Reviewed-by: Max Ihlenfeldt <m...@igalia.com>

Cr-Commit-Position: refs/heads/main@{#1507464}

Files:

M services/network/trust_tokens/trust_token_database_owner.cc
M services/network/trust_tokens/trust_token_database_owner.h
M ui/ozone/platform/wayland/host/wayland_connection.cc
M ui/ozone/platform/wayland/host/wayland_connection.h
M ui/ozone/platform/wayland/host/wayland_cursor_factory.cc
M ui/ozone/platform/wayland/host/wayland_screen.cc
M ui/ozone/platform/wayland/host/wayland_screen.h
M ui/ozone/platform/wayland/ozone_platform_wayland.cc

Change size: S

Delta: 8 files changed, 23 insertions(+), 11 deletions(-)

Branch: refs/heads/main

Submit Requirements:

Code-Review: +1 by Max Ihlenfeldt, +1 by Charlie Harrison

Open in Gerrit

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

open

diffy

satisfied_requirement

Reply all

Reply to author

Forward

Enable connection/cursor cleanup on Linux [chromium/src : main]

AbdAlRahman Gad (Gerrit)

AbdAlRahman Gad added 1 comment

Related details

AbdAlRahman Gad (Gerrit)

Related details

Max Ihlenfeldt (Gerrit)

Max Ihlenfeldt added 2 comments

Related details

Max Ihlenfeldt (Gerrit)

Max Ihlenfeldt added 1 comment

Related details

AbdAlRahman Gad (Gerrit)

AbdAlRahman Gad added 3 comments

Related details

Max Ihlenfeldt (Gerrit)

Max Ihlenfeldt added 1 comment

Related details

AbdAlRahman Gad (Gerrit)

AbdAlRahman Gad voted and added 1 comment

Votes added by AbdAlRahman Gad

1 comment

Related details

Max Ihlenfeldt (Gerrit)

Max Ihlenfeldt added 1 comment

Related details

AbdAlRahman Gad (Gerrit)

AbdAlRahman Gad added 1 comment

Related details

Max Ihlenfeldt (Gerrit)

Max Ihlenfeldt added 1 comment

Related details

AbdAlRahman Gad (Gerrit)

AbdAlRahman Gad added 1 comment

Related details

Max Ihlenfeldt (Gerrit)

Max Ihlenfeldt added 1 comment

Related details

AbdAlRahman Gad (Gerrit)

AbdAlRahman Gad added 1 comment

Related details

Max Ihlenfeldt (Gerrit)

Max Ihlenfeldt added 1 comment

Related details

AbdAlRahman Gad (Gerrit)

AbdAlRahman Gad added 1 comment

Related details

Max Ihlenfeldt (Gerrit)

Max Ihlenfeldt added 1 comment

Related details

AbdAlRahman Gad (Gerrit)

AbdAlRahman Gad added 1 comment

Related details

Max Ihlenfeldt (Gerrit)

Max Ihlenfeldt voted and added 2 comments

Votes added by Max Ihlenfeldt

2 comments

Related details

AbdAlRahman Gad (Gerrit)

AbdAlRahman Gad added 1 comment

Related details

Max Ihlenfeldt (Gerrit)

Max Ihlenfeldt voted and added 1 comment

Votes added by Max Ihlenfeldt

1 comment

Related details

Charlie Harrison (Gerrit)

Charlie Harrison added 1 comment

Related details

AbdAlRahman Gad (Gerrit)

AbdAlRahman Gad added 1 comment

Related details

Charlie Harrison (Gerrit)

Charlie Harrison voted Code-Review+1

Related details

AbdAlRahman Gad (Gerrit)

AbdAlRahman Gad voted Commit-Queue+2

Related details

Chromium LUCI CQ (Gerrit)

Chromium LUCI CQ submitted the change