Autoroll from main to staging

[cobalt-github-releaser-bot]

Automated cherry-pick roll to staging.

Original pull requests:

• Cherry pick PR #8615: Mojo implementation for updater APIs #10666
• fix: Add missing semicolon in starboard_renderer_unittest #10697
• Cherry pick PR #8803: Conditionally add binding in mojo for sideloading APIs #10667
• Implement base MemoryContext TLS mapping and Allocator Observers #10539
• Cherry pick PR #8637: Web tests for h5vcc updater #10668
• Cherry pick PR #9868: cobalt: Register dummy H5vccUpdater binders #10694
• h5vcc: Re-enable passing web tests #10643
• media: Add configurable decommit strategy #10323
• starboard: use gold linker instead of default ld #10566
• Deprecate SbFileAtomicReplace #10699
• media: Fix kMediaTimeCheckInterval unit #10706
• Reland: "Prune WebXR to reduce android binary size" #10693
• Disable memfd_create #10712
• [POSIX] Add inotify API #10183
• starboard: Rename internal SbThread* priority helper functions #10684
• cobalt: Disable HTTP Cache #10612
• cobalt: Remove stale leveldb lock files on startup #10664
• cobalt/infra: Enable cobalt_memory_instrumentation_unittests  #10708
• android: Remove unneeded not_empty.txt asset placeholders #10517
• Posix: register alarm #10705
• media: Reduce unnecessary logging #10470
• cobalt: Handle URL fragments for splash screen #10552
• android: Always resample audio samples to float #10675
• Deprecate starboard/thread.h #10717
• Revert "Implement base MemoryContext TLS mapping and Allocator Observers" #10723

[gemini-code-assist]

Code Review

This pull request removes deprecated Starboard APIs (such as SbFileAtomicReplace and SbThreadId) in favor of standard POSIX equivalents, introduces a configurable decommit strategy for the decoder buffer allocator, adds a feature to delete stale local storage lock files, and separates sideloading updater APIs into a new Mojo interface. Feedback on these changes highlights a potential temporary file leak on failure in FileAtomicReplace, redundant decommit system calls when reclaiming already decommitted blocks, a missing validation check for zero block size in H5vccSettings, and a style guide violation where auto is used instead of auto* for pointers.

[gemini-code-assist]

If unlink(path) or rename fails, the temporary file created at temp_path is leaked on the disk. We should unlink temp_path on failure to prevent temporary file accumulation and potential disk space exhaustion.

  if (file_exists && unlink(path)) {
    unlink(temp_path.data());
    return false;
  }
  if (rename(temp_path.data(), path) != 0) {
    unlink(temp_path.data());
    return false;
  }

[gemini-code-assist]

When reclaiming fallback blocks, if a block is already in a decommitted state (kIdleDecommitted or kIdleFreed), setting its state back to kIdlePendingDecommit or kIdlePendingFree and setting has_pending_decommits_ = true will cause the allocator to redundantly call Decommit (which invokes madvise) on it again. This introduces unnecessary system call overhead every time the allocator transitions to idle. We should only transition blocks to pending decommit states if they are not already decommitted.

void ReuseAllocatorBase::ReclaimFallbackBlocks() {
  SB_LOG(INFO) << "Allocator reached idle state, reclaiming "
               << fallback_allocations_.size() << " fallback allocations.";
  allocation_counter_ = 0;
  for (size_t i = 0; i < fallback_allocations_.size(); ++i) {
    auto& fallback_block = fallback_allocations_[i];
    if (i < retain_blocks_) {
      fallback_block.state = kIdleRetained;
    } else if (i < retain_blocks_ + conservative_decommit_blocks_) {
      if (fallback_block.state != kIdleFreed &&
          fallback_block.state != kIdleDecommitted) {
        fallback_block.state = kIdlePendingFree;
        has_pending_decommits_ = true;
      }
    } else {
      if (fallback_block.state != kIdleDecommitted) {
        fallback_block.state = kIdlePendingDecommit;
        has_pending_decommits_ = true;
      }
    }
  }
}

[gemini-code-assist]

If block_size_mb is extracted as 0 (which can happen if the packed integer has 0 in the corresponding byte, even if the overall integer is positive), it will result in a block size of 0 being passed to EnableConfigurableDecommitStrategy. This can cause division-by-zero or other undefined behaviors in the allocator. We should explicitly validate that block_size_mb > 0 and return false if it is not.

    return ProcessSettingAsPositiveInt(
        script_state, exception_context, name, *value, [](int value) {
          bool aggressive_decommit_on_suspend = ((value >> 24) & 0xFF) != 0;
          int block_size_mb = (value >> 16) & 0xFF;
          if (block_size_mb == 0) {
            return false;
          }
          int retain_blocks = (value >> 8) & 0xFF;
          int conservative_decommit_blocks = value & 0xFF;
          ::media::DecoderBufferAllocator::EnableConfigurableDecommitStrategy(
              block_size_mb * 1024 * 1024, retain_blocks,
              conservative_decommit_blocks, aggressive_decommit_on_suspend);
          return true;
        });

[gemini-code-assist]

According to the Chromium style guide, we should use auto* instead of auto for pointers to keep them clearly visible as pointers. This also maintains consistency with the other methods in this file.

Suggested change

	auto updater_module = cobalt::updater::UpdaterModule::GetInstance();
	auto* updater_module = cobalt::updater::UpdaterModule::GetInstance();

References

1. All code submitted to this repository must adhere to the established upstream Chromium style guides. Chromium style guide recommends using auto* for pointers. ^(link)