Thomas Anderson (Gerrit)

unread,

Jul 20, 2026, 9:51:35 PM (2 days ago) Jul 20

to Lei Zhang, chromium...@chromium.org, Sadrul Chowdhury, ozone-...@chromium.org, roblia...@chromium.org, sky+...@chromium.org

Attention needed from Lei Zhang

Thomas Anderson voted and added 1 comment

Votes added by Thomas Anderson

Commit-Queue

+1

1 comment

Patchset-level comments

File-level comment, Patchset 2 (Latest):

Thomas Anderson . resolved

I need to learn to stop clicking accept on the LLM-generated `weak_this` fixes.

Open in Gerrit

Related details

Attention is currently required from:

Lei Zhang

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Lei Zhang (Gerrit)

unread,

Jul 20, 2026, 9:57:33 PM (2 days ago) Jul 20

to Thomas Anderson, Lei Zhang, Chromium LUCI CQ, chromium...@chromium.org, Sadrul Chowdhury, ozone-...@chromium.org, roblia...@chromium.org, sky+...@chromium.org

Attention needed from Thomas Anderson

Lei Zhang voted and added 4 comments

Votes added by Lei Zhang

Code-Review

+1

4 comments

File ui/base/x/x11_desktop_window_move_client.cc

Line 17, Patchset 2 (Latest): : window_(window) {}

Lei Zhang . unresolved

Add: `CHECK(window_);`

File ui/ozone/platform/x11/x11_window.cc

Line 560, Patchset 2 (Parent): const gfx::Rect current_bounds = GetBoundsInPixels();

Lei Zhang . unresolved

Save the result and reuse?

Line 956, Patchset 2 (Parent): const gfx::Rect bounds = GetBoundsInPixels();

Lei Zhang . unresolved

Reuse

Line 2054, Patchset 2 (Parent): const gfx::Rect bounds = GetBoundsInPixels();

Lei Zhang . unresolved

Reuse

Open in Gerrit

Related details

Attention is currently required from:

Thomas Anderson

Submit Requirements:

Code-Coverage
Code-Owners

Code-Review
No-Unresolved-Comments
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

unsatisfied_requirement

open

diffy

Thomas Anderson (Gerrit)

unread,

Jul 20, 2026, 10:10:40 PM (2 days ago) Jul 20

to Lei Zhang, Chromium LUCI CQ, chromium...@chromium.org, Sadrul Chowdhury, ozone-...@chromium.org, roblia...@chromium.org, sky+...@chromium.org

Thomas Anderson voted and added 4 comments

Votes added by Thomas Anderson

Commit-Queue

+1

4 comments

File ui/base/x/x11_desktop_window_move_client.cc

Line 17, Patchset 2: : window_(window) {}

Lei Zhang . resolved

Add: `CHECK(window_);`

Thomas Anderson

Done

File ui/ozone/platform/x11/x11_window.cc

Line 560, Patchset 2 (Parent): const gfx::Rect current_bounds = GetBoundsInPixels();

Lei Zhang . resolved

Save the result and reuse?

Thomas Anderson

Done

Line 956, Patchset 2 (Parent): const gfx::Rect bounds = GetBoundsInPixels();

Lei Zhang . resolved

Reuse

Thomas Anderson

Done

Line 2054, Patchset 2 (Parent): const gfx::Rect bounds = GetBoundsInPixels();

Lei Zhang . resolved

Reuse

Thomas Anderson

Done

Open in Gerrit

Related details

Attention set is empty

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review

Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

open

diffy

Thomas Anderson (Gerrit)

unread,

Jul 21, 2026, 2:06:44 PM (2 days ago) Jul 21

to Lei Zhang, Chromium LUCI CQ, chromium...@chromium.org, Sadrul Chowdhury, ozone-...@chromium.org, roblia...@chromium.org, sky+...@chromium.org

Thomas Anderson voted Commit-Queue+2

Commit-Queue

+2

Open in Gerrit

Related details

Attention set is empty

Submit Requirements:

Code-Coverage
Code-Owners
Code-Review
Review-Enforcement

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

satisfied_requirement

open

diffy

Chromium LUCI CQ (Gerrit)

unread,

Jul 21, 2026, 2:11:24 PM (2 days ago) Jul 21

to Thomas Anderson, Lei Zhang, chromium...@chromium.org, Sadrul Chowdhury, ozone-...@chromium.org, roblia...@chromium.org, sky+...@chromium.org

Chromium LUCI CQ submitted the change with unreviewed changes

Unreviewed changes

2 is the latest approved patch-set.
The change was submitted with unreviewed changes in the following files:

```
The name of the file: ui/ozone/platform/x11/x11_window.cc
Insertions: 9, Deletions: 6.

@@ -556,10 +556,11 @@
   gfx::Rect new_bounds_in_pixels(bounds.origin(),
                                  AdjustSizeForDisplay(bounds.size()));
 
+  const gfx::Rect current_bounds = GetBoundsInPixels();
   const bool size_changed =
-      GetBoundsInPixels().size() != new_bounds_in_pixels.size();
+      current_bounds.size() != new_bounds_in_pixels.size();
   const bool origin_changed =
-      GetBoundsInPixels().origin() != new_bounds_in_pixels.origin();
+      current_bounds.origin() != new_bounds_in_pixels.origin();
 
   // Assume that the resize will go through as requested, which should be the
   // case if we're running without a window manager.  If there's a window
@@ -915,10 +916,11 @@
 }
 
 void X11Window::MoveCursorTo(const gfx::Point& location_px) {
+  const gfx::Rect bounds = GetBoundsInPixels();
   connection_->WarpPointer(x11::WarpPointerRequest{
       .dst_window = x_root_window_,
-      .dst_x = static_cast<int16_t>(GetBoundsInPixels().x() + location_px.x()),
-      .dst_y = static_cast<int16_t>(GetBoundsInPixels().y() + location_px.y()),
+      .dst_x = static_cast<int16_t>(bounds.x() + location_px.x()),
+      .dst_y = static_cast<int16_t>(bounds.y() + location_px.y()),
   });
   // The cached cursor location is no longer valid.
   X11EventSource::GetInstance()->ClearLastCursorLocation();
@@ -1981,8 +1983,9 @@
   x11::SizeHints size_hints = {};
   connection_->GetWmNormalHints(xwindow_, &size_hints);
   size_hints.flags |= x11::SIZE_HINT_P_POSITION;
-  size_hints.x = GetBoundsInPixels().x();
-  size_hints.y = GetBoundsInPixels().y();
+  const gfx::Rect bounds = GetBoundsInPixels();
+  size_hints.x = bounds.x();
+  size_hints.y = bounds.y();
   // Set STATIC_GRAVITY so that the window position is not affected by the
   // frame width when running with window manager.
   size_hints.flags |= x11::SIZE_HINT_P_WIN_GRAVITY;
```
```
The name of the file: ui/base/x/x11_desktop_window_move_client.cc
Insertions: 4, Deletions: 1.

@@ -4,6 +4,7 @@
 
 #include "ui/base/x/x11_desktop_window_move_client.h"
 
+#include "base/check.h"
 #include "base/functional/callback_helpers.h"
 #include "ui/base/x/x11_util.h"
 #include "ui/events/event.h"
@@ -14,7 +15,9 @@
 X11DesktopWindowMoveClient::Delegate::~Delegate() = default;
 
 X11DesktopWindowMoveClient::X11DesktopWindowMoveClient(Delegate* window)
-    : window_(window) {}
+    : window_(window) {
+  CHECK(window_);
+}
 
 X11DesktopWindowMoveClient::~X11DesktopWindowMoveClient() = default;
 
```

Change information

Commit message:

[Ozone/X11] Revert workaround UAF guards for GeometryCache synchronous dispatch

Now that GeometryCache::GetBoundsPx() peeks at X11 server responses
instead of calling DispatchNow(), event processing and bounds-changed
callbacks no longer execute synchronously during bounds calculation.

This change reverts the temporary WeakPtr liveness guards and unit tests
that were added to handle re-entrancy during GetBoundsPx() /
GetBoundsInPixels():
- Revert "Harden X11DesktopWindowMoveClient against synchronous destruction"
- Revert "Fix use-after-free in DesktopWindowTreeHostPlatform::CenterWindow"
- Revert "ozone/x11: Fix potential UAF in X11Window::DispatchEvent"
- Revert "Ozone: Fix UAF in X11Window::DispatchUiEvent via weak_ptr tracking"
- Revert "Fix UAF in X11Window::SetOverrideRedirect and BrowserDesktopWindowTreeHostLinux"
- Revert "[Ozone/X11] Guard against synchronous deletion in OnWindowMapped"
- Revert "ozone/x11: Fix UAF inside X11Window::GetBoundsInPixels()"

Bug: 524439798, 524824288, 532966375, 524552123, 524395469, 523690961, 524825209, 518245882, 517050585, 518043597

Change-Id: I8a3a311e8ea209e16e06d1179a1fb00b915c00fb

Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8129120

Reviewed-by: Lei Zhang <the...@chromium.org>

Commit-Queue: Thomas Anderson <thomasa...@chromium.org>

Cr-Commit-Position: refs/heads/main@{#1665631}

Files:

M chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.cc
M chrome/browser/ui/views/frame/browser_desktop_window_tree_host_linux.h
M ui/base/x/BUILD.gn
M ui/base/x/x11_desktop_window_move_client.cc
M ui/base/x/x11_desktop_window_move_client.h
D ui/base/x/x11_desktop_window_move_client_unittest.cc
M ui/ozone/platform/x11/x11_window.cc
M ui/ozone/platform/x11/x11_window.h
M ui/ozone/platform/x11/x11_window_ozone_unittest.cc
M ui/views/widget/desktop_aura/desktop_window_tree_host_platform.cc
M ui/views/widget/desktop_aura/desktop_window_tree_host_platform_unittest.cc

Change size: L

Delta: 11 files changed, 16 insertions(+), 685 deletions(-)

Branch: refs/heads/main

Submit Requirements:

Code-Review: +1 by Lei Zhang

Open in Gerrit

Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings.

Gerrit

open

diffy

satisfied_requirement

Reply all

Reply to author

Forward

[Ozone/X11] Revert workaround UAF guards for GeometryCache synchronous dispatch [chromium/src : main]

Thomas Anderson (Gerrit)

Thomas Anderson voted and added 1 comment

Votes added by Thomas Anderson

1 comment

Related details

Lei Zhang (Gerrit)

Lei Zhang voted and added 4 comments

Votes added by Lei Zhang

4 comments

Related details

Thomas Anderson (Gerrit)

Thomas Anderson voted and added 4 comments

Votes added by Thomas Anderson

4 comments

Related details

Thomas Anderson (Gerrit)

Thomas Anderson voted Commit-Queue+2

Related details

Chromium LUCI CQ (Gerrit)

Chromium LUCI CQ submitted the change with unreviewed changes

Unreviewed changes

Change information