From 4751fc6afc4af8c0a09b548d7d199013a3fd6b5c Mon Sep 17 00:00:00 2001 From: Carmelo Messina Date: Fri, 10 Jul 2026 13:34:12 +0200 Subject: [PATCH] Supporting Dangling Ptr Detection via BackupRefPtr: Fixes the incorrect sequence of the dtor when creating icons on the home screen (#2922) --- ...gling-Ptr-Detection-via-BackupRefPtr.patch | 21 ++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/build/patches/Supporting-Dangling-Ptr-Detection-via-BackupRefPtr.patch b/build/patches/Supporting-Dangling-Ptr-Detection-via-BackupRefPtr.patch index 004cf265..7b4464c0 100644 --- a/build/patches/Supporting-Dangling-Ptr-Detection-via-BackupRefPtr.patch +++ b/build/patches/Supporting-Dangling-Ptr-Detection-via-BackupRefPtr.patch @@ -23,9 +23,10 @@ License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html .../compositor/CompositorViewHolder.java | 2 +- .../layouts/LayoutManagerChromeTablet.java | 12 ++++---- ...ngling-Ptr-Detection-via-BackupRefPtr.grdp | 9 ++++++ + .../webapps/AddToHomescreenMediator.java | 4 +-- .../Enable-Partition-Alloc-BRP-Checks.inc | 11 +++++++ .../platform/wtf/allocator/partitions.cc | 10 +------ - 11 files changed, 76 insertions(+), 28 deletions(-) + 12 files changed, 78 insertions(+), 30 deletions(-) create mode 100644 chrome/browser/ui/android/strings/cromite_android_chrome_strings_grd/Supporting-Dangling-Ptr-Detection-via-BackupRefPtr.grdp create mode 100644 cromite_flags/chrome/browser/about_flags_cc/Enable-Partition-Alloc-BRP-Checks.inc @@ -262,6 +263,24 @@ new file mode 100644 + Enable checking raw pointer do not become dangling during their lifetime to prevent UAF and write a fixed cookie pattern at the end of each allocation to ensure there is no OOB write. + + +diff --git a/components/webapps/browser/android/java/src/org/chromium/components/webapps/AddToHomescreenMediator.java b/components/webapps/browser/android/java/src/org/chromium/components/webapps/AddToHomescreenMediator.java +--- a/components/webapps/browser/android/java/src/org/chromium/components/webapps/AddToHomescreenMediator.java ++++ b/components/webapps/browser/android/java/src/org/chromium/components/webapps/AddToHomescreenMediator.java +@@ -114,12 +114,12 @@ class AddToHomescreenMediator implements AddToHomescreenViewDelegate { + } + + private void onFlowCompleted() { ++ mOnFlowCompleted.run(); ++ + if (mNativeAddToHomescreenMediator != 0) { + AddToHomescreenMediatorJni.get().destroy(mNativeAddToHomescreenMediator); + mNativeAddToHomescreenMediator = 0; + } +- +- mOnFlowCompleted.run(); + } + + @NativeMethods diff --git a/cromite_flags/chrome/browser/about_flags_cc/Enable-Partition-Alloc-BRP-Checks.inc b/cromite_flags/chrome/browser/about_flags_cc/Enable-Partition-Alloc-BRP-Checks.inc new file mode 100644 --- /dev/null