[M149] [Ozone/Wayland] Fix UAF in WaylandWindow bubble activation/removal [chromium/src : refs/branch-heads/7827]
0 views
Skip to first unread message
Thomas Anderson (Gerrit)
Jun 24, 2026, 6:43:35 PM (4 days ago) Jun 24
to Thomas Lukaszewicz, chromium...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org
Attention needed from Thomas Lukaszewicz
Thomas Anderson voted![]( "Open in Gerrit")
| Auto-Submit | +1 |
| Commit-Queue | +1 |
Related details
Attention is currently required from:
- Thomas Lukaszewicz
Submit Requirements:
Code-Owners
Code-Review
Lint
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Thomas Lukaszewicz (Gerrit)
Jun 24, 2026, 7:09:36 PM (4 days ago) Jun 24
to Thomas Anderson, Chromium LUCI CQ, chromium...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org
Attention needed from Thomas Anderson
Thomas Lukaszewicz voted![]( "Open in Gerrit")
Attention is currently required from:
- Thomas Anderson
Submit Requirements:
Code-Owners
Code-Review
Lint
Review-Enforcement
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Chromium LUCI CQ (Gerrit)
Jun 24, 2026, 8:04:44 PM (4 days ago) Jun 24
to Thomas Anderson, Thomas Lukaszewicz, chromium...@chromium.org, max+watc...@igalia.com, nickdiego+wa...@igalia.com, ozone-...@chromium.org
Chromium LUCI CQ submitted the change![]( "Open in Gerrit")
Change information
Commit message:
[M149] [Ozone/Wayland] Fix UAF in WaylandWindow bubble activation/removal
Original change's description:
> [Ozone/Wayland] Fix UAF in WaylandWindow bubble activation/removal
>
> The delegate callback OnActivationChanged() on top-level/bubble windows
> may synchronously destroy the underlying platform window (e.g. if the
> associated widget closes synchronously).
>
> This CL adds base::WeakPtr guards to WaylandWindow::ActivateBubble() and
> WaylandWindow::RemoveBubble() immediately after invoking these callbacks
> to check if the window was destroyed, returning early if so. It also
> ensures child bubbles are safely erased from the child list only if they
> are still present.
>
> Fixed: 524584791
> Change-Id: Ia4c921dab990cbb5795a74d2a03e32155197fbfb
> Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7958809
> Commit-Queue: Thomas Lukaszewicz <tl...@chromium.org>
> Auto-Submit: Thomas Anderson <thomasa...@chromium.org>
> Reviewed-by: Thomas Lukaszewicz <tl...@chromium.org>
> Cr-Commit-Position: refs/heads/main@{#1648660}
(cherry picked from commit 9f9a3573e334d4f3aa2b09dfa7825aa30738a276)
Fixed: 525281203
Bug: 524584791
Change-Id: Ic7641e90a9eaeeb67d6004b2c3b64d2e6dd68052
Reviewed-by: Thomas Lukaszewicz <tl...@chromium.org>
Commit-Queue: Thomas Lukaszewicz <tl...@chromium.org>
Commit-Queue: Thomas Anderson <thomasa...@chromium.org>
Auto-Submit: Thomas Anderson <thomasa...@chromium.org>
Cr-Commit-Position: refs/branch-heads/7827@{#3808}
Cr-Branched-From: 9f3e9aaccba63bd2ec30334e45e0bfd07ebcc8f1-refs/heads/main@{#1625079}
Files:
- M ui/ozone/platform/wayland/host/wayland_window.cc
- M ui/ozone/platform/wayland/host/wayland_window_unittest.cc
Change size: M
Delta: 2 files changed, 78 insertions(+), 3 deletions(-)
Branch: refs/branch-heads/7827
Submit Requirements:
Code-Review: +1 by Thomas Lukaszewicz
| Inspect html for hidden footers to help with email filtering. To unsubscribe visit settings. |
Reply all
Reply to author
Forward
0 new messages