[skia-sync] Merge upstream chrome/m153 - #350
Merged
Merged
Conversation
Original change's description: > Fix UAF in SkCachedData::internalUnref > > Destroy AutoMutexWritable before calling delete this in > SkCachedData::internalUnref to avoid unlocking the mutex after the > object has been deleted. > > This was found while trying to enable the MiraclePtr rewrite > that would protect "this" and cause deterministic termination. > Fixed: 553345874 > Bug: 351867706 > Doc: https://bit.ly/miracleptr-skia > Change-Id: I0a1d3aed3b3d41e4ed06505295a14028ff634788 > Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1340596 > Reviewed-by: Michael Ludwig <michaelludwig@google.com> > Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org> (cherry picked from commit d7c1561) Bug: 553827434,553345874,351867706 Change-Id: I0a1d3aed3b3d41e4ed06505295a14028ff634788 Reviewed-on: https://skia-review.googlesource.com/c/skia/+/1348216 Auto-Submit: Chrome Cherry Picker <chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com> Commit-Queue: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com> Bot-Commit: rubber-stamper@appspot.gserviceaccount.com <rubber-stamper@appspot.gserviceaccount.com>
14 tasks
mattleibow
added
partner/agentic-workflows
mattleibow
marked this pull request as ready for review
September 3, 2026 04:31
mattleibow
added a commit
to mono/SkiaSharp
that referenced
this pull request
Sep 3, 2026
[skia-sync] Merge upstream chrome/m153 bug fixes (#4927) Requires: mono/skia#350 Changes: mono/skia@ca4e52c...92dc1a6 Advance the mono/skia submodule within milestone 153 to include the upstream SkCachedData::internalUnref use-after-free fix. The previous implementation could delete SkCachedData before its AutoMutexWritable guard released the object's mutex. The upstream correction records the unref result, destroys the guard, and only then deletes the object, preventing an unlock through freed memory. Keep chrome_milestone and product versions at 153. Update the cgmanifest upstream commit to 4f574af24448 and point both its Skia registration and the submodule gitlink at the actual mono/skia merge commit 92dc1a61df70. That merge has the reviewed native commit d87457da65b2 as its second parent and an identical tree, so the repin preserves the source that passed the native Linux x64 build, binding regeneration, and full managed test solution. Co-authored-by: Matthew Leibowitz <mattleibow@live.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Note
Required merge method
Merge commit only. Do not squash or rebase this PR. The two-parent merge ancestry is required
so future syncs can prove which upstream commits are already integrated.
Description
Automated upstream merge of
chrome/m153.This pull request was produced by skia-upstream-sync.
SkiaSharp issue
N/A — automated upstream synchronization.
Required SkiaSharp PR
Requires mono/SkiaSharp#4927
Areas affected
include/c,src/c)DEPSChanges
Two-parent merge of upstream
chrome/m153intoskiasharp(fork baseca4e52cbb95210aaf4cc5d2deaa32b478a28429a).chrome/m1539d07e5bad9e3e21da2426946e589daa6472182714f574af2444846ceca4d277a8095c5d4229d175f— [M153] Fix UAF in SkCachedData::internalUnrefd87457da65b27386267485bb10253b5ab9112121(parents: fork base + target upstream)The range is a single upstream commit touching exactly one file,
src/core/SkCachedData.cpp: it destroys theAutoMutexWritableRAII guard beforedelete thisininternalUnref, fixing a use-after-free (mutex unlocked after theowning object was freed).
audit_fork_patches.py --validatereports 0 added / 0 changed / 0 removed. Every fork patch preserved.DEPSbyte-identical between fork base and target;skia-dependency-changes.jsonshowschanges: []. No revision, cgmanifest, or Component Governance change.include/corsrc/c; no GN build-list changes.Testing
Native library built from source on Linux/x64 (
externals-linux --arch=x64,libSkiaSharp.so.153.0.0,libHarfBuzzSharp.so.0.61421.0). Bindings regenerated: nonew native functions, no generated diff. Full unfiltered
tests/SkiaSharp.Tests.Console.slnx(net10.0/x64) passed:No
GpuPolicy-required backend was skipped; the Vulkan backend (lavapipe) initializedand executed. Remaining skips are the existing platform-policy skips (Direct3D on
Linux, etc.).
Human review
Checklist
skiasharpbranchChangesabove lists every added/changed C API export or states that none changedmono/SkiaSharpPR linked aboveLast rendered by the sync workflow: 2026-09-03T00:49:16Z