Autoroll from main to 27.lts

[cobalt-github-releaser-bot]

Automated cherry-pick roll to 27.lts.

Original pull requests:

• android: Enable MediaCodec unit testing via dependency injection #10659
• Prune Web Bluetooth, WebUSB, WebHID, Web Serial, and Web NFC #10488
• Update SB testing doc #10744
• media: Avoid per-iteration heap allocations in MediaCodecDecoder audio loop #10747
• refactor(ci): add test subtypes and runs_on to test_targets.json #10686
• ci: Set test_attempts to 1 #10753
• Prune WebGPU/Dawn to reduce android binary size #10729
• fix: Make VP9 Profile 2 optional for non-HDR devices in MinimumSupport #10580
• Add Finch config related UMAs #10671
• Disable sigaltstack and sched_getcpu #10738
• Reland #10539 - 'Implement base MemoryContext TLS mapping and Allocator Observers'  #10725
• media: Reuse scratch buffer in MP4StreamParser for Starboard #10749
• Posix: Add wrappers for _Exit #10743
• starboard: Move experiment features #10766
• Add getpriority to allowed symbols list #10768
• Remove dlopen and dlsym by removing tflite #10683
• android: Fix Java heap leak in AudioTrackBridge JNI #10745
• media: Disable WetRtc processing for Cobalt #10471
• Bring sync chromium branches logic into autoroll. #10186
• Refactor on_host_tests to use dynamically passed test executables #10767
• starboard: Add ScopedFeatureList for testing #10754
• feat(lifecycle): implement race-free and spec-compliant application lifecycle transitions #10416
• media: Erase id_to_mime_map_ entry on RemoveId #10776

[gemini-code-assist]

Code Review

This pull request introduces a multi-process lifecycle coordination mechanism for Cobalt, adding a browser-side CobaltLifecycleManager and a renderer-side CobaltLifecycleController to handle asynchronous lifecycle ACKs. It also adds memory context tracking, suspends hang watching during application freeze, and optimizes media parsing and binary size by stubbing out unused Blink modules. The review feedback highlights critical security and performance issues: multiple Use-After-Free (UAF) vulnerabilities in CobaltLifecycleController and CobaltLifecycleManager due to unsafe object references in asynchronous tasks, a performance bottleneck in the memory observer's thread-name lookup, and potential undefined behavior in the MP4 stream parser when accessing an empty vector.

[gemini-code-assist]

In GetCurrentOSThreadName(), checking tls_thread_name[0] == '\0' to determine if the thread name has been initialized is highly problematic. If a thread does not have a name set, pthread_getname_np will succeed but write an empty string (i.e., tls_thread_name[0] remains \0). This causes pthread_getname_np (a system call) to be invoked on every single allocation on that thread, introducing a massive performance bottleneck in a very hot path.

Additionally, on Android versions older than API 26, __builtin_available will be evaluated on every allocation.

We should use a separate thread_local bool to track whether the thread name has been initialized, ensuring pthread_getname_np is called at most once per thread.

const char* GetCurrentOSThreadName() {
  static thread_local char tls_thread_name[32] = {0};
  static thread_local bool tls_thread_name_initialized = false;
  if (!tls_thread_name_initialized) {
    tls_thread_name_initialized = true;
#if BUILDFLAG(IS_ANDROID)
    if (__builtin_available(android 26, *)) {
      if (pthread_getname_np(pthread_self(), tls_thread_name, sizeof(tls_thread_name)) != 0) {
        tls_thread_name[0] = '\0';
      }
    }
#else
    if (pthread_getname_np(pthread_self(), tls_thread_name, sizeof(tls_thread_name)) != 0) {
      tls_thread_name[0] = '\0';
    }
#endif
  }
  return tls_thread_name[0] != '\0' ? tls_thread_name : nullptr;
}

[gemini-code-assist]

In OnMojoDisconnect(), accessing context.web_contents directly is unsafe. When a WebContents is destroyed, OnWebContentsDestroyed() is called synchronously, which cleans up the maps but does not synchronously destroy the Mojo receivers. The Mojo disconnect callbacks are dispatched asynchronously on the message loop. By the time OnMojoDisconnect() runs, context.web_contents is a dangling pointer, leading to a Use-After-Free (UAF) vulnerability when used as a key in UnregisterFrame().

We should verify that the web_contents pointer is still valid by checking if it exists in trackers_ before calling UnregisterFrame().

Suggested change

	void CobaltLifecycleManager::OnMojoDisconnect() {
	CHECK_CALLED_ON_VALID_THREAD(thread_checker_);
	FrameContext context = receivers_.current_context();
	if (context.web_contents) {
	UnregisterFrame(context.web_contents, context.frame);
	}
	}
	void CobaltLifecycleManager::OnMojoDisconnect() {
	CHECK_CALLED_ON_VALID_THREAD(thread_checker_);
	FrameContext context = receivers_.current_context();
	if (context.web_contents && trackers_.find(context.web_contents) != trackers_.end()) {
	UnregisterFrame(context.web_contents, context.frame);
	}
	}

[gemini-code-assist]

Passing std::ref(remote_observer_) to base::BindOnce inside NotifyObserver is extremely dangerous. CobaltLifecycleController is a garbage-collected object. If it is garbage-collected before the posted task runs, the reference to remote_observer_ will be dangling, leading to a Use-After-Free (UAF) crash when the lambda executes.

We should capture this via WrapWeakPersistent(this) to safely manage the lifetime of the garbage-collected object.

  NotifyObserver(base::BindOnce(
      [](CobaltLifecycleController* controller, bool visible) {
        if (controller && controller->remote_observer_.is_bound()) {
          controller->remote_observer_->OnPageVisibilityChanged(visible);
        }
      },
      WrapWeakPersistent(this), visible));

[gemini-code-assist]

Passing std::ref(remote_observer_) to base::BindOnce inside NotifyObserver is extremely dangerous. CobaltLifecycleController is a garbage-collected object. If it is garbage-collected before the posted task runs, the reference to remote_observer_ will be dangling, leading to a Use-After-Free (UAF) crash when the lambda executes.

We should capture this via WrapWeakPersistent(this) to safely manage the lifetime of the garbage-collected object.

  bool is_focused = GetPage() && GetPage()->GetFocusController().IsFocused();
  NotifyObserver(base::BindOnce(
      [](CobaltLifecycleController* controller, bool is_focused) {
        if (controller && controller->remote_observer_.is_bound()) {
          if (is_focused) {
            controller->remote_observer_->OnPageFocused();
          } else {
            controller->remote_observer_->OnPageBlurred();
          }
        }
      },
      WrapWeakPersistent(this), is_focused));

[gemini-code-assist]

Passing std::ref(remote_observer_) to base::BindOnce inside NotifyObserver is extremely dangerous. CobaltLifecycleController is a garbage-collected object. If it is garbage-collected before the posted task runs, the reference to remote_observer_ will be dangling, leading to a Use-After-Free (UAF) crash when the lambda executes.

We should capture this via WrapWeakPersistent(this) to safely manage the lifetime of the garbage-collected object.

  if (state == mojom::blink::FrameLifecycleState::kRunning) {
    NotifyObserver(base::BindOnce(
        [](CobaltLifecycleController* controller) {
          if (controller && controller->remote_observer_.is_bound()) {
            controller->remote_observer_->OnPageResumed();
          }
        },
        WrapWeakPersistent(this)));
  }

[gemini-code-assist]

Using &frame_buf[0] on a potentially empty vector is undefined behavior in C++ and can cause crashes or assertions in hardened STL configurations.

We should use base::span<const uint8_t>{frame_buf} directly, which is safe and idiomatic.

      stream_buf = StreamParserBuffer::CopyFrom(
          base::span<const uint8_t>{frame_buf},
          is_keyframe, buffer_type, runs_->track_id());

[datadog-cobalt-youtube]

✨ Fix all issues with Cursor

⚠️ Warnings

🧪 1 Test failed

❄️ Known flaky: DiesOnResurrectedHeapHashSetMember from HeapDeathTest     (Fix with Cursor)

Test crashed

[ RUN      ] HeapDeathTest.DiesOnResurrectedHeapHashSetMember

ℹ️ Info

No other issues found (see more)

❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 5c044e9 | Docs | Give us feedback!}