153.0.8010.53..154.0.8037.57

commit 73c14f6228d7cd537c855007e8f88678969cc0eb 154.0.8037.57 author Sky Malice Tue Sep 22 00:09:16 2026 committer Sky Malice Tue Sep 22 00:09:16 2026 [M154] [AIM] Remove redundant SearchBoxViewBinder focusability post workaround Original change's description: > [AIM] Remove redundant SearchBoxViewBinder focusability post workaround > > Removing the temporary focusability toggling in SearchBoxViewBinder > prevents the unattached mRunQueue memory leak on NTP destruction and the > 940ms startup focusability black-out window. Focus theft during tab > creation is already prevented by FeedSurfaceCoordinator.RootView being > focusable. > > TAG=agy > CONV=cc9b69da-d31b-4686-ab81-a133755c7905 > > Bug: 562983348, 562538356, 548448339 > Change-Id: Ic9516194268d5db4a61b2703035fc550156eb3c3 > Reviewed-on: > Reviewed-by: Tomasz Wiszkowski > Reviewed-by: Samuel Huang > Commit-Queue: Sky Malice > Cr-Commit-Position: refs/heads/main@{#1700802} (cherry picked from commit 777b0256af7e5019576783636171c210951c3a59) TAG=agy CONV=0a162794-16ec-4aca-b019-5c42822d945a Bug: 564439220, 562983348, 562538356, 548448339 Change-Id: Ic9516194268d5db4a61b2703035fc550156eb3c3 Reviewed-on: Reviewed-by: Samuel Huang Bot-Commit: [email protected] Reviewed-by: Tomasz Wiszkowski Cr-Commit-Position: refs/branch-heads/8037@{#1293} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chrome/android/java/src/org/chromium/chrome/browser/ntp/ /SearchBoxViewBinder.java [ diff ] chrome/android/junit/src/org/chromium/chrome/browser/ntp/ /SearchBoxViewBinderUnitTest.java [ diff ]

chrome/android/java/src/org/chromium/chrome/browser/ntp/ /SearchBoxViewBinder.java [ diff ]

chrome/android/junit/src/org/chromium/chrome/browser/ntp/ /SearchBoxViewBinderUnitTest.java [ diff ]

commit 3cd04f35c2a5c680f7362505994c40362e3aef89 author Samuel Huang Tue Sep 22 00:08:49 2026 committer Sky Malice Tue Sep 22 00:08:49 2026 [M154] [Android NTP] Fix unfocusable @id/ntp_content descendants Original change's description: > [Android NTP] Fix unfocusable @id/ntp_content descendants > > crrev.com/c/8279777 tries to prevent the Fake Box (FSB) from > stealing keyboard focus from the Omnibox by changing `NewTabPageLayout` > (`@id/ntp_content`) so its descendants are blocked from gaining focus. > However, this causes the following keyboard regressions: > * The FSB components, including its EditBox (with blinking cursor) and > its buttons can no longer be navigated by keyboard. > * {Most Visited Tiles (MVT), Chrome Tips, Magic Stack} can no longer be > navigated by keyboard. > > This CL fixes the regression without regressing the intended fix. Key > ideas: > * Limit blast radius to `@id/search_box_text`, which is the culprit > for focus stealing; Feeds and other boxes (e.g., MVT) should have been > benign. > * Block the Edit text (now `@id/search_box_text`, which is stored as > `SearchBoxContainerView.mHintTextView`) from gaining focus, and > re-enable after a render pass (via `post()`). > > Details: > * `NewTabPageLayout`: Remove the call > `setDescendantFocusability(ViewGroup.FOCUS_BLOCK_DESCENDANTS);`. > * `SearchBoxViewBinder.bind()`: After `SEARCH_BOX_CLICK_CALLBACK` case > calls `mHintTextView.setOnClickListener()`, call `setFocusable(false)` > on `mHintTextView`, then `post()` `setFocusable(true)`. > > Bug: 562538356, 548448339 > Change-Id: I3e7fd9ea1ed522a5ad85307b85e181676186984b > Reviewed-on: > Commit-Queue: Samuel Huang > Reviewed-by: Tomasz Wiszkowski > Reviewed-by: Sky Malice > Cr-Commit-Position: refs/heads/main@{#1699966} (cherry picked from commit 2cca6a0d5357daa971f147f884de2e81220c7db4) TAG=agy CONV=0a162794-16ec-4aca-b019-5c42822d945a Bug: 564439220, 562538356, 548448339 Change-Id: I3e7fd9ea1ed522a5ad85307b85e181676186984b Reviewed-on: Reviewed-by: Tomasz Wiszkowski Commit-Queue: Sky Malice Bot-Commit: [email protected] Cr-Commit-Position: refs/branch-heads/8037@{#1292} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chrome/android/java/src/org/chromium/chrome/browser/ntp/NewTabPageLayout.java [ diff ] chrome/android/java/src/org/chromium/chrome/browser/ntp/ /SearchBoxViewBinder.java [ diff ]

chrome/android/java/src/org/chromium/chrome/browser/ntp/NewTabPageLayout.java [ diff ]

chrome/android/java/src/org/chromium/chrome/browser/ntp/ /SearchBoxViewBinder.java [ diff ]

commit b502960f0163dd76f462366436db99c45ff0422c author chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Tue Sep 22 00:06:59 2026 committer chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Tue Sep 22 00:06:59 2026 Incrementing VERSION to 154.0.8037.57 Merge-Approval-Bypass: Chrome release infra Change-Id: I6b664976415cdc439c9f8f9c24900a3f35928e16 Reviewed-on: Bot-Commit: chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/8037@{#1291} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chrome/VERSION [ diff ]

chrome/VERSION [ diff ]

commit c067d1a69f034cd4bfae6ae5b6911c1678f910b9 154.0.8037.56 author Alex Mitra Mon Sep 21 23:34:17 2026 committer Chromium LUCI CQ Mon Sep 21 23:34:17 2026 [M154] Mark ConstructableStylesheetCache as test Original change's description: > Mark ConstructableStylesheetCache as test > > We are seeing a massive spike in renderer process memory. According to > our field profile, this can be attributed to retention of decoded > webfonts as a result of Preemptively > turning this off to confirm its the root cause of the regression. > > > ConstructableStylesheetCache caches StyleSheetContents for constructible > stylesheets in StyleEngine. The unbounded caching of stylesheets > containing @font-face rules leads to severe memory regressions due to > retained decoded web fonts (crbug.com/558040077). > > Bug: 558040077 > Change-Id: I9b13d0952b9cbe9d65cd43543c804cbe6dfff8ee > Reviewed-on: > Commit-Queue: Alex Mitra > Reviewed-by: Philip Rogers > Cr-Commit-Position: refs/heads/main@{#1700172} (cherry picked from commit 88d254e381454914868d4c3fe0c8ad7cca4d00d2) Bug: 563280854,558040077 Change-Id: I9b13d0952b9cbe9d65cd43543c804cbe6dfff8ee Reviewed-on: Bot-Commit: [email protected] Commit-Queue: Krishna Govind Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/8037@{#1290} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} third_party/blink/renderer/platform/runtime_enabled_features.json5 [ diff ]

third_party/blink/renderer/platform/runtime_enabled_features.json5 [ diff ]

commit 0945c5778f46837d2e68ceccad0eb61c7b6b4ff3 author Kunjan Vinay Patel Mon Sep 21 21:37:13 2026 committer Chromium LUCI CQ Mon Sep 21 21:37:13 2026 [M154] Fix Web Target dropping shared files in WebAPKs Original change's description: > Fix Web Target dropping shared files in WebAPKs > > Problem: In Chrome 153+, Web Target in installed WebAPKs drops all > shared files (while text and title arrive normally). > > Root Cause: CL 8280393 ("Verify caller URI permissions before Web > Target in TWA") added permission checks in > TwaSharingController.deliverToShareTarget() via > WebAppLaunchHandler.filterShareData(). This assumed all launches > either stash EXTRA_VERIFIED_SHARE_DATA in the trampoline > (LaunchIntentDispatcher) or have a CCT SessionHolder. WebAPKs launch via > WebappLauncherActivity (which previously did not stash verified > data) and have no CCT session, causing all file URIs to be rejected. > > Solution: > - Adds WebAppLaunchHandler.copyShareDataPermissionsForWebApk() to verify > caller URI permissions during WebAPK launches, mirroring the TWA > trampoline pattern. > - Calls this helper in WebappLauncherActivity and stashes verified > data into EXTRA_VERIFIED_SHARE_DATA on the launch intent. > - Properly handles text-only shares and defensively guards caller checks > on Android 15+. > - Adds unit tests in WebappLauncherActivityTest and WebAppLaunchHandlerTest > for partial filtering, invalid schemes, and text-only shares. > > Bug: 561685220 > Change-Id: Iabe25a8f9e56d7691d99b548e028ecef9ec4353d > Reviewed-on: > Reviewed-by: Daniel Murphy > Reviewed-by: Sinan Sahin > Commit-Queue: Kunjan Patel > Cr-Commit-Position: refs/heads/main@{#1701288} (cherry picked from commit 0fbfe9f03c5854e92e44de8e531b9cbad6f049c3) Bug: 564519990,561685220 Change-Id: Iabe25a8f9e56d7691d99b548e028ecef9ec4353d Reviewed-on: Reviewed-by: Krishna Govind Owners-Override: Krishna Govind Commit-Queue: Krishna Govind Reviewed-by: Jinsuk Kim Commit-Queue: Kunjan Patel Cr-Commit-Position: refs/branch-heads/8037@{#1289} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chrome/android/java/src/org/chromium/chrome/browser/customtabs/content/WebAppLaunchHandler.java [ diff ] chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappLauncherActivity.java [ diff ] chrome/android/junit/src/org/chromium/chrome/browser/customtabs/content/WebAppLaunchHandlerTest.java [ diff ] chrome/android/junit/src/org/chromium/chrome/browser/webapps/WebappLauncherActivityTest.java [ diff ]

chrome/android/java/src/org/chromium/chrome/browser/customtabs/content/WebAppLaunchHandler.java [ diff ]

chrome/android/java/src/org/chromium/chrome/browser/webapps/WebappLauncherActivity.java [ diff ]

chrome/android/junit/src/org/chromium/chrome/browser/customtabs/content/WebAppLaunchHandlerTest.java [ diff ]

chrome/android/junit/src/org/chromium/chrome/browser/webapps/WebappLauncherActivityTest.java [ diff ]

commit e0697a7915d9b689ba30ace494c5a563836c803f author David Yeung Mon Sep 21 20:55:18 2026 committer Chromium LUCI CQ Mon Sep 21 20:55:18 2026 [M154] Guard against widget destruction during show and hide Original change's description: > Guard against widget destruction during show and hide > > Delegating window visibility changes to the native widget in > Widget::Show(), Widget::ShowInactive(), and Widget::Hide() can > synchronously trigger window observer callbacks, focus changes, or > capture loss that destroy the underlying aura window and free the Widget > instance before the call returns. > > Fix is to acquire a WeakPtr and check if the widget was destroyed to > prevent any UAFs. > > Fixed: 553136141 > Change-Id: Ie27e7d9b46a23df033045ac6f6603362f16b5734 > Reviewed-on: > Commit-Queue: Keren Zhu > Reviewed-by: Keren Zhu > Cr-Commit-Position: refs/heads/main@{#1697039} (cherry picked from commit 6080f65e48f96ee710060f982eb0a4a006919ac5) Bug: 561875319,553136141 Change-Id: Ie27e7d9b46a23df033045ac6f6603362f16b5734 Reviewed-on: Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Commit-Queue: David Yeung Bot-Commit: [email protected] Cr-Commit-Position: refs/branch-heads/8037@{#1288} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} ui/views/widget/widget.cc [ diff ]

ui/views/widget/widget.cc [ diff ]

commit e340661ab95f2ad7bb2de33e9fff355df781c801 author Zhenyao Mo Mon Sep 21 20:26:07 2026 committer Chromium LUCI CQ Mon Sep 21 20:26:07 2026 [M154] gpu: Reset base level for ASTC compressed image uploads Rename reset_base_level_for_astc_sub_image to reset_base_level_for_astc_image, and apply it to glCompressedTexImage2D and glCompressedTexImage3D in addition to sub-image calls. For ASTC textures when base_level > 0, base_level is reset to 0 before compressed image calls and restored afterwards to work around a PowerVR driver bug. (cherry picked from commit d3f0c0ea4955d94e51c461eace31719de13b2bfa) Bug: 563219444,551708184 Change-Id: I29ae9c8037e160eb9d4604b0256042308156c7ed Reviewed-on: Reviewed-by: Kenneth Russell Commit-Queue: Zhenyao Mo Cr-Original-Commit-Position: refs/heads/main@{#1699003} Reviewed-on: Cr-Commit-Position: refs/branch-heads/8037@{#1287} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} gpu/command_buffer/service/gles2_cmd_decoder.cc [ diff ] gpu/command_buffer/tests/compressed_texture_test.cc [ diff ] gpu/config/gpu_driver_bug_list.json [ diff ] gpu/config/gpu_workaround_list.txt [ diff ]

gpu/command_buffer/service/gles2_cmd_decoder.cc [ diff ]

gpu/command_buffer/tests/compressed_texture_test.cc [ diff ]

gpu/config/gpu_driver_bug_list.json [ diff ]

gpu/config/gpu_workaround_list.txt [ diff ]

commit 859c41c1c73c41aee9bf318cb9eaaa880c37c43f author chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Mon Sep 21 20:07:55 2026 committer chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Mon Sep 21 20:07:55 2026 Incrementing VERSION to 154.0.8037.56 Merge-Approval-Bypass: Chrome release infra Change-Id: Ic1696caecc302e12fe6a0640ba0d32f3dbde9e30 Reviewed-on: Bot-Commit: chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/8037@{#1286} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chrome/VERSION [ diff ]

chrome/VERSION [ diff ]

commit 56bce727aaf876133349e2171e8aff019fad23ef 154.0.8037.55 author chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Mon Sep 21 19:04:46 2026 committer chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Mon Sep 21 19:04:46 2026 Roll commits from side projects in M154 Roll src/third_party/angle in M154 from 5f345cc26453 to 1ff8799c596d Commits rolled: Generated by: Merge-Approval-Bypass: Chrome DEPS-autoroller Change-Id: If8957b45672dccb78bcbce1b715dac6a5bcca13a Reviewed-on: Bot-Commit: chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/8037@{#1285} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} DEPS [ diff ] third_party/angle [ diff ]

third_party/angle [ diff ]

commit 9e47e25654935a74cb3cbe5c7d0a50cd06e8c7b6 author Dana Fried Mon Sep 21 18:45:30 2026 committer Chromium LUCI CQ Mon Sep 21 18:45:30 2026 [M154] [Views] Harden FocusManager against callbacks during AdvanceFocus Original change's description: > [Views] Harden FocusManager against callbacks during AdvanceFocus > > Now if any callback happens during AdvanceFocus that would cause the > view to be deleted, it should be handled gracefully. > > Fixed: 562242429 > Change-Id: Ia0c69027d491e9264369814110973ebe1389f84f > Reviewed-on: > Commit-Queue: Dana Fried > Reviewed-by: Mickey Burks > Cr-Commit-Position: refs/heads/main@{#1699939} (cherry picked from commit 8b5549467725a5e444c8a45c2d6f131c9fc0ca73) Bug: 563677716,562242429 Change-Id: Ia0c69027d491e9264369814110973ebe1389f84f Reviewed-on: Bot-Commit: [email protected] Commit-Queue: Dana Fried Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/8037@{#1284} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} ui/views/focus/focus_manager.cc [ diff ] ui/views/focus/focus_manager_unittest.cc [ diff ]

ui/views/focus/focus_manager.cc [ diff ]

ui/views/focus/focus_manager_unittest.cc [ diff ]

ios/chrome/browser/crash_report/model/features.cc [ diff ]

ios/chrome/browser/crash_report/model/features.h [ diff ]

commit b5298b48ab696b47f61b5108875e97fca4140c6a author [email protected] Mon Sep 21 18:37:25 2026 committer Chromium LUCI CQ Mon Sep 21 18:37:25 2026 Roll Amd64 AFDO from 154.0.8037.42_rc-r1-merged to 154.0.8037.52_rc-r1-merged This CL may cause a small binary size increase, roughly proportional to how long it's been since our last AFDO profile roll. For larger increases (around or exceeding 100KB), please file go/crostc-bug. Please note that, despite rolling to chrome/android, this profile is used for both Linux and Android. If this roll has caused a breakage, revert this CL and set the roller to dry run mode using the controls here: Please CC [email protected],[email protected],[email protected] on the revert to ensure that a human is aware of the problem. To file a bug in Chromium Beta Branch: To report a problem with the AutoRoller itself, please file a bug: Documentation for the AutoRoller is here: Tbr: [email protected] Merge-Approval-Bypass: Chrome autoroller Change-Id: I2af3f1f4cbb60ffb4e3519f1ee9e010c82251aa1 Reviewed-on: Bot-Commit: [email protected] Commit-Queue: [email protected] Cr-Commit-Position: refs/branch-heads/8037@{#1282} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chrome/android/profiles/newest.txt [ diff ]

chrome/android/profiles/newest.txt [ diff ]

commit fb122ae7a8238ca10933b44049518e6ca7c1b6fd author Hailey Wang Mon Sep 21 18:37:14 2026 committer Chromium LUCI CQ Mon Sep 21 18:37:14 2026 [M154] [Signin][Android] Enable the FRE in demo mode on desktop Original change's description: > [Signin][Android] Enable the FRE in demo mode on desktop > > Prior to this CL, the FRE was suppressed on all devices in retail demo > mode. This prevented the signed-in experience from being showcased on > Android Desktop demo devices, where first-party apps like Workspace > services are surfaced through Trusted Web Activities and therefore > depend on sign-in propagating to those services. > > Restrict the suppression to non-desktop devices so that the FRE, and > the "Make Chrome your own" dialog in particular, is shown on desktop > demo devices. Phones and tablets, including Pixel retail demo devices, > keep the existing behavior. Whether sign-in is actually available on a > demo device continues to be controlled by Android account visibility. > > TAG=agy > CONV=717a4dc9-2e6e-45bc-9e1d-62db9c86aaad > > Bug: 503740233 > Change-Id: Ic71cf51309c8c0c27cfd789015ac9f6863f6f6e7 > Reviewed-on: > Commit-Queue: Hailey Wang > Reviewed-by: Sky Malice > Cr-Commit-Position: refs/heads/main@{#1700217} (cherry picked from commit 06d424c05e4cd5646c19c72bdbb27379f06d6bbe) Bug: 563464905,503740233 Change-Id: Ic71cf51309c8c0c27cfd789015ac9f6863f6f6e7 Reviewed-on: Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Bot-Commit: [email protected] Commit-Queue: Krishna Govind Cr-Commit-Position: refs/branch-heads/8037@{#1281} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chrome/android/java/src/org/chromium/chrome/browser/firstrun/FirstRunFlowSequencer.java [ diff ] chrome/android/junit/src/org/chromium/chrome/browser/firstrun/FirstRunFlowSequencerTest.java [ diff ]

chrome/android/java/src/org/chromium/chrome/browser/firstrun/FirstRunFlowSequencer.java [ diff ]

chrome/android/junit/src/org/chromium/chrome/browser/firstrun/FirstRunFlowSequencerTest.java [ diff ]

commit dc5f4121343e2363ef5c225fca578bc74c59a956 author Evan Stade Mon Sep 21 18:29:42 2026 committer Chromium LUCI CQ Mon Sep 21 18:29:42 2026 [M154] IDB: SQLite store - fix FSA handles in incognito profiles Original change's description: > IDB: SQLite store - fix FSA handles in incognito profiles > > Also add coverage via virtual test suite. > > Bug: 562119515 > Change-Id: I4d7611e3d6fdb14cc0c86bffd27634833bfaa85d > Reviewed-on: > Reviewed-by: Rahul Singh > Auto-Submit: Evan Stade > Commit-Queue: Rahul Singh > Reviewed-by: Jonathan Lee > Cr-Commit-Position: refs/heads/main@{#1699256} (cherry picked from commit 909a0222ba0f48ace3fd3a011b379dcd998871bb) Bug: 563369477,562119515 Change-Id: I4d7611e3d6fdb14cc0c86bffd27634833bfaa85d Reviewed-on: Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Commit-Queue: Srinivas Sista Bot-Commit: [email protected] Cr-Commit-Position: refs/branch-heads/8037@{#1280} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} content/browser/indexed_db/instance/sqlite/database_connection.cc [ diff ] third_party/blink/web_tests/VirtualTestSuites [ diff ] third_party/blink/web_tests/virtual/indexeddb_in_memory/README.md [Added - diff ]

content/browser/indexed_db/instance/sqlite/database_connection.cc [ diff ]

third_party/blink/web_tests/VirtualTestSuites [ diff ]

third_party/blink/web_tests/virtual/indexeddb_in_memory/README.md [Added - diff ]

commit 6211b748e88b4000ca1c3cc36925a928c3b55e1d author [email protected] Mon Sep 21 18:29:27 2026 committer Chromium LUCI CQ Mon Sep 21 18:29:27 2026 Roll ChromeOS Arm AFDO profile from 154-8037.15-1789351979-benchmark-154.0.8037.42-r1 to 154-8037.15-1789351979-benchmark-154.0.8037.51-r1 If this roll has caused a breakage, revert this CL and set the roller to dry run mode using the controls here: Please CC [email protected],[email protected],[email protected] on the revert to ensure that a human is aware of the problem. To file a bug in Chromium Beta Branch: To report a problem with the AutoRoller itself, please file a bug: Documentation for the AutoRoller is here: Tbr: [email protected] Merge-Approval-Bypass: Chrome autoroller Change-Id: I186c7b5f58f10c208afd5e4c42d6e4c8d923039e Reviewed-on: Bot-Commit: [email protected] Commit-Queue: [email protected] Cr-Commit-Position: refs/branch-heads/8037@{#1279} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chromeos/profiles/arm.afdo.newest.txt [ diff ]

chromeos/profiles/arm.afdo.newest.txt [ diff ]

commit a4974f117e6a774b5523481663a6f8af3710c04c author [email protected] Mon Sep 21 18:08:55 2026 committer Chromium LUCI CQ Mon Sep 21 18:08:55 2026 Roll ChromeOS Bigcore AFDO profile from 154-8037.15-1789356154-benchmark-154.0.8037.42-r1 to 154-8037.15-1789356154-benchmark-154.0.8037.52-r1 If this roll has caused a breakage, revert this CL and set the roller to dry run mode using the controls here: Please CC [email protected],[email protected],[email protected] on the revert to ensure that a human is aware of the problem. To file a bug in Chromium Beta Branch: To report a problem with the AutoRoller itself, please file a bug: Documentation for the AutoRoller is here: Tbr: [email protected] Merge-Approval-Bypass: Chrome autoroller Change-Id: I669fab1765fcfa09eb76c838478fd448224d3daf Reviewed-on: Commit-Queue: [email protected] Bot-Commit: [email protected] Cr-Commit-Position: refs/branch-heads/8037@{#1278} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chromeos/profiles/bigcore.afdo.newest.txt [ diff ]

chromeos/profiles/bigcore.afdo.newest.txt [ diff ]

commit 017349c97b99682f6b82fb57ed4bfcb7a9acb960 author chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Mon Sep 21 18:05:28 2026 committer chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Mon Sep 21 18:05:28 2026 Roll commits from side projects in M154 Roll src/third_party/angle in M154 from ce1d1ce88c93 to 5f345cc26453 Commits rolled: Generated by: Merge-Approval-Bypass: Chrome DEPS-autoroller Change-Id: I610478de942aabb32da8580103dcd7b61f3b50d6 Reviewed-on: Bot-Commit: chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/8037@{#1277} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} DEPS [ diff ] third_party/angle [ diff ]

third_party/angle [ diff ]

commit 684eee0f52e869dea323d6ce4451ce0c7a8737c8 author Andrew Paseltiner Mon Sep 21 17:57:07 2026 committer Chromium LUCI CQ Mon Sep 21 17:57:07 2026 [M154] Ensure callback outlives decryptor in BackendDecryptor Original change's description: > Ensure callback outlives decryptor in BackendDecryptor > > Reorder class members in BackendDecryptor so that decrypt_cb_ and > task_runner_ are declared before decryptor_. Because member destruction > proceeds in reverse declaration order, this ensures that callback and > task runner dependencies remain valid if the decryptor aborts pending > operations and synchronously notifies its delegate during destruction. > > Additionally, add checks before executing decrypt_cb_, validate that > pending_buffers_ is not empty in OnDecryptComplete, remove a redundant > TaskRunnerImpl allocation in the constructor, and add unit tests. > > Fixed: 534997484 > Change-Id: Ie4a45392bb55c7b48e108136c87b35427f1f4d2d > Reviewed-on: > Commit-Queue: Andrew Paseltiner > Reviewed-by: Shawn Quereshi > Cr-Commit-Position: refs/heads/main@{#1699864} (cherry picked from commit e2f094b952dcc91519eb8c7122c0b3aed203613d) Bug: 563677002,534997484 Change-Id: Ie4a45392bb55c7b48e108136c87b35427f1f4d2d Reviewed-on: Reviewed-by: Andrew Paseltiner Bot-Commit: [email protected] Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Commit-Queue: [email protected] Cr-Commit-Position: refs/branch-heads/8037@{#1276} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chromecast/media/cma/BUILD.gn [ diff ] chromecast/media/cma/pipeline/backend_decryptor.cc [ diff ] chromecast/media/cma/pipeline/backend_decryptor.h [ diff ] chromecast/media/cma/pipeline/backend_decryptor_unittest.cc [Added - diff ]

chromecast/media/cma/BUILD.gn [ diff ]

chromecast/media/cma/pipeline/backend_decryptor.cc [ diff ]

chromecast/media/cma/pipeline/backend_decryptor.h [ diff ]

chromecast/media/cma/pipeline/backend_decryptor_unittest.cc [Added - diff ]

commit fca579274b442299abd0bfda2f1028e635e53901 author [email protected] Mon Sep 21 17:36:13 2026 committer Chromium LUCI CQ Mon Sep 21 17:36:13 2026 Roll ChromeOS Atom AFDO profile from 154-8037.15-1789352910-benchmark-154.0.8037.42-r1 to 154-8037.15-1789352910-benchmark-154.0.8037.52-r1 If this roll has caused a breakage, revert this CL and set the roller to dry run mode using the controls here: Please CC [email protected],[email protected],[email protected] on the revert to ensure that a human is aware of the problem. To file a bug in Chromium Beta Branch: To report a problem with the AutoRoller itself, please file a bug: Documentation for the AutoRoller is here: Tbr: [email protected] Merge-Approval-Bypass: Chrome autoroller Change-Id: Ia36327419fd8fd1313585072e39f060e04972d98 Reviewed-on: Bot-Commit: [email protected] Commit-Queue: [email protected] Cr-Commit-Position: refs/branch-heads/8037@{#1275} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chromeos/profiles/atom.afdo.newest.txt [ diff ]

chromeos/profiles/atom.afdo.newest.txt [ diff ]

commit e54d8df5d414d3acc9c2f282dada44e12ed5070c author Federica Germinario Mon Sep 21 17:32:38 2026 committer Chromium LUCI CQ Mon Sep 21 17:32:38 2026 [M154] [ios] Fix crash in lens code when image is nil Original change's description: > [ios] Fix crash in lens code when image is nil > > Lens code it's already handling the case in which rawImageData or image > are nil (this is done in imageSource.isValid). > > This change removes the CHECK since code already handles this case. > Order in LensImageSource* imageSource was changed to be as close as possible to original M153 logic since plan is to CP this to M154 (even though this is likely a no-op). > > Change-Id: Ifba6752423245b212576f3dc27b7b5cc4f67690b > Bug: 562124475 > Reviewed-on: > Reviewed-by: Rohit Rao > Auto-Submit: Federica Germinario > Commit-Queue: Federica Germinario > Reviewed-by: Radu Nitescu > Cr-Commit-Position: refs/heads/main@{#1701691} (cherry picked from commit d068fc7b612e73e1d47215344f61bc20c6d615f1) Bug: 563449693,562124475 Change-Id: Ifba6752423245b212576f3dc27b7b5cc4f67690b Reviewed-on: Bot-Commit: [email protected] Reviewed-by: Federica Germinario Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Commit-Queue: Krishna Govind Commit-Queue: Federica Germinario Cr-Commit-Position: refs/branch-heads/8037@{#1274} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} ios/chrome/browser/lens_overlay/coordinator/lens_overlay_coordinator.mm [ diff ]

ios/chrome/browser/lens_overlay/coordinator/lens_overlay_coordinator.mm [ diff ]

commit 399b0e6625fa5e94bfcd7d9f2d3d41c62e006eed author chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Mon Sep 21 16:05:36 2026 committer chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Mon Sep 21 16:05:36 2026 Roll commits from side projects in M154 Roll src/third_party/angle in M154 from 5382ed032a48 to ce1d1ce88c93 Commits rolled: Generated by: Merge-Approval-Bypass: Chrome DEPS-autoroller Change-Id: Id070845c61919d0cc3868045e897cfdc8b6f7c04 Reviewed-on: Bot-Commit: chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/8037@{#1273} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} DEPS [ diff ] third_party/angle [ diff ]

third_party/angle [ diff ]

commit b7a41a69c56e78e4479aeff3d3186aad479dab4b author Paweł Stus Mon Sep 21 15:48:17 2026 committer Krishna Govind Mon Sep 21 15:48:17 2026 [M154] Fix the 154 stable release crashes. Original change's description: > Fix the 154 stable release crashes. > > In that CL > a > DCHECK was changed to a CHECK in > AutofillProfileComparator::MergePhoneNumbers. This introduced crashes > during the deduplication. Crash happens when merging phone numbers that > look like that: > * 164xxxxxxxx > * +64xxxxxxxx > (xxxxxxx parts are equal for both phone numbers) At the M154 branch, > during the merge, phone numbers are parsed twice. During the first parse > (one that happens without acknowledging the country code of the profile) > since they both what looks like NSN (64xxxxxxxx) the method > proceeds. During the second parse (that has profile’s country code > passed in as a hint), when the parser sees + before the phone number it > might override the passed in region hint with a region that it inferred > from the digits after the plus sign. In this case +64 - New Zealand. > Thus the resulting phone numbers look like: > * 1 64xxxxxxxx > * 64 xxxxxxxx > One with the country code of US (1) and the other with the country code > of NZ (64). A CHECK that crashes during the deduplication checks an > invariant that states: “If both numbers have international country > codes, than these country codes must be equal.” > > Shortly after landing the CL that introduced a crash an another CL that > refactors the same method was landed: > > This CL gets rid of the first parse. The condition that used to run on > the result of that first parse, now runs on the results of the second > parse. This condition rejects a merge in a presented case - returns an > equivalent of false instead of crashing. > > This CL introduces a fix for the initial bug. Instead of crashing it > returns an equivalent of false. > > Bug: 562376957 > Change-Id: Ic8a2dfcbcdf9e15d85077b862729233e713b5524 > Reviewed-on: > Reviewed-by: Christoph Schwering > Commit-Queue: Josef Raska > Reviewed-by: Tamino Bauknecht > Reviewed-by: Jihad Hanna > Reviewed-by: Josef Raska > Cr-Commit-Position: refs/heads/main@{#1699662} (cherry picked from commit 97f43814c358c85e06817c6803e023c99ed6f465) Bug: 562469097,562376957 Cq-Exclude-Trybots: chromium/try:win-rel Change-Id: Ic8a2dfcbcdf9e15d85077b862729233e713b5524 Reviewed-on: Reviewed-by: Josef Raska Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Reviewed-by: Florian Leimgruber Reviewed-by: Jihad Hanna Cr-Commit-Position: refs/branch-heads/8037@{#1272} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} components/autofill/core/browser/data_model/addresses/autofill_profile_comparator.cc [ diff ] components/autofill/core/browser/data_model/addresses/autofill_profile_comparator_unittest.cc [ diff ]

components/autofill/core/browser/data_model/addresses/autofill_profile_comparator.cc [ diff ]

components/autofill/core/browser/data_model/addresses/autofill_profile_comparator_unittest.cc [ diff ]

commit 80eca5e9767ab5c2c71d4f60064f0db785a6ced7 author chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Mon Sep 21 00:04:54 2026 committer chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Mon Sep 21 00:04:54 2026 Incrementing VERSION to 154.0.8037.55 Merge-Approval-Bypass: Chrome release infra Change-Id: Iba6e7a6050fa67f5105496c55a88004b196167c0 Reviewed-on: Bot-Commit: chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/8037@{#1271} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chrome/VERSION [ diff ]

chrome/VERSION [ diff ]

commit 55a4f7d0f8abef10a36b3222afb1fc253f0f74e5 154.0.8037.54 author chromeos-ci-prod Sun Sep 20 15:54:53 2026 committer Chromium LUCI CQ Sun Sep 20 15:54:53 2026 chromeos/CHROMEOS_LKGM: Automatic uprev to 16805.22.0. Diff Link: Generated by PUpr, see for job details. BUG=None TEST=CQ Pupr-Upstream-Versions: [{"ref": "refs/heads/release-R154-16805.B-snapshot", "repository": "/chromeos/manifest-internal", "revision": "5be8b5bc00b57191b4a53bd2bdc4ef64ba854a6f"}] Cq-Cl-Tag: pupr:chromeos-lkgm Merge-Approval-Bypass: Automated LKGM update Override-Tryjobs-For-Automation: luci.chrome-m154.try:chromeos-betty-chrome-gtest-and-tast; luci.chromium-m154.try:chromeos-amd64-generic-rel,chromeos-arm64-generic-rel,linux-presubmit Change-Id: I6ecb68fa9be143fc874fde13be9fb76058217e4a Reviewed-on: Bot-Commit: [email protected] Commit-Queue: [email protected] Cr-Commit-Position: refs/branch-heads/8037@{#1270} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chromeos/CHROMEOS_LKGM [ diff ]

chromeos/CHROMEOS_LKGM [ diff ]

commit ae0c62c9d3131ea95723f82591222f9aae06dbb3 author chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Sun Sep 20 00:06:57 2026 committer chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Sun Sep 20 00:06:57 2026 Incrementing VERSION to 154.0.8037.54 Merge-Approval-Bypass: Chrome release infra Change-Id: I6140b1e5aae18b21a2a4810c5add1e90f5ceeb0f Reviewed-on: Bot-Commit: chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/8037@{#1269} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chrome/VERSION [ diff ]

chrome/VERSION [ diff ]

commit 51929beb352558099525a14f9945ed71d8b4897c 154.0.8037.53 author Zhenyao Mo Sat Sep 19 23:26:24 2026 committer Chromium LUCI CQ Sat Sep 19 23:26:24 2026 [M154] Ensure CompoundImageBacking::GetGpuBacking() validates latest content ID Original change's description: > Ensure CompoundImageBacking::GetGpuBacking() validates latest content ID > > When multiple GPU backings exist (e.g. with dynamic backing allocation > where the initial lazy GPU backing is resolved and rejected by > SupportsAccess() before a compatible backing is dynamically allocated), > GetGpuBacking() previously returned the first non-memory element in > |elements_| regardless of its content_id_. > > Because CreateBackingFromBackingFactory() marks newly created GPU > backings as cleared when a shared memory backing is present, calling > CopyToGpuMemoryBuffer() or CopyToGpuMemoryBufferAsync() could select the > uninitialized or stale GPU backing instead of the active backing holding > latest_content_id_, copying uninitialized VRAM into shared memory. > > Update GetGpuBacking() to check HasLatestContent(element) so only a GPU > backing holding the latest content is selected as the readback source, > and guard against null gpu_backing dereferences in error logging when no > GPU backing holds the latest content. > > To cover this, CreateSharedMemoryForTesting() takes an optional > SharedImageFactoryRef. Supplying one makes the dynamic allocation branch > of GetOrAllocateBacking() reachable from the unit test, so the > regression test reproduces the bug entirely through the public API: a > single ProduceSkia() call resolves the initial GPU element, rejects it > via SupportsAccess(), and dynamically allocates a second element, and a > Skia BeginScopedWriteAccess() then makes that second element the holder > of the latest content. No test code mutates CompoundImageBacking state > directly. > > SharedImageFactory itself needs no GL context here: its constructor > returns early once GL is reported as disabled, and registering the > existing TestSharedImageBackingFactory via > RegisterSharedImageBackingFactoryForTesting() makes dynamic allocations > produce TestImageBackings. That process-global GL override lives in a > dedicated fixture so it applies only to these two tests. > > Bug: 537857253 > Change-Id: I24e319a5e3fb273618ca4c7edbc834329929e253 > Reviewed-on: > Commit-Queue: Zhenyao Mo > Reviewed-by: Vasiliy Telezhnikov > Cr-Commit-Position: refs/heads/main@{#1699945} (cherry picked from commit 2f291ea16923b2f39b5b7154c0dfa321520f07f5) Bug: 563676871,537857253 Change-Id: I24e319a5e3fb273618ca4c7edbc834329929e253 Reviewed-on: Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Bot-Commit: [email protected] Commit-Queue: Zhenyao Mo Cr-Commit-Position: refs/branch-heads/8037@{#1268} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} gpu/command_buffer/service/shared_image/compound_image_backing.cc [ diff ] gpu/command_buffer/service/shared_image/compound_image_backing.h [ diff ] gpu/command_buffer/service/shared_image/compound_image_backing_unittest.cc [ diff ]

gpu/command_buffer/service/shared_image/compound_image_backing.cc [ diff ]

gpu/command_buffer/service/shared_image/compound_image_backing.h [ diff ]

gpu/command_buffer/service/shared_image/compound_image_backing_unittest.cc [ diff ]

commit 3ea86fdcfc7e27e60a9b3412df1a65fb66c2b7e3 author chromeos-ci-prod Sat Sep 19 16:02:45 2026 committer Chromium LUCI CQ Sat Sep 19 16:02:45 2026 chromeos/CHROMEOS_LKGM: Automatic uprev to 16805.21.0. Diff Link: Generated by PUpr, see for job details. BUG=None TEST=CQ Pupr-Upstream-Versions: [{"ref": "refs/heads/release-R154-16805.B-snapshot", "repository": "/chromeos/manifest-internal", "revision": "51d1e6e22e85452112b4bd46ab31f9ef8a37a9af"}] Cq-Cl-Tag: pupr:chromeos-lkgm Merge-Approval-Bypass: Automated LKGM update Override-Tryjobs-For-Automation: luci.chrome-m154.try:chromeos-betty-chrome-gtest-and-tast; luci.chromium-m154.try:chromeos-amd64-generic-rel,chromeos-arm64-generic-rel,linux-presubmit Change-Id: I857fd9b5d7ffff4a2af832ce97a955c90cdd1c11 Reviewed-on: Commit-Queue: [email protected] Bot-Commit: [email protected] Cr-Commit-Position: refs/branch-heads/8037@{#1267} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chromeos/CHROMEOS_LKGM [ diff ]

chromeos/CHROMEOS_LKGM [ diff ]

commit 70eb517b296db9e6a9871fc6c9b71be2c0c97dd8 author Andrey Kosyakov Sat Sep 19 02:20:47 2026 committer Chromium LUCI CQ Sat Sep 19 02:20:47 2026 [M154] Improve JSON validation of CDP messages from renderer Original change's description: > Improve JSON validation of CDP messages from renderer > > Fixed: 553116160 > Change-Id: I42324ac5add7f35dfa769b0f5f89c8a0ca517839 > Reviewed-on: > Commit-Queue: Andrey Kosyakov > Auto-Submit: Andrey Kosyakov > Reviewed-by: Johannes Henkel > Reviewed-by: Peter Kvitek > Cr-Commit-Position: refs/heads/main@{#1697766} (cherry picked from commit da9c2ff3df4b5f24d537e530ff0e2b88b5ec8695) Bug: 562325777,553116160 Change-Id: I42324ac5add7f35dfa769b0f5f89c8a0ca517839 Reviewed-on: Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Bot-Commit: [email protected] Commit-Queue: [email protected] Cr-Commit-Position: refs/branch-heads/8037@{#1266} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} content/browser/devtools/devtools_session.cc [ diff ]

content/browser/devtools/devtools_session.cc [ diff ]

commit 619094a9bb49e107a28a7a4506db363dec076371 author Kameron Lutes Sat Sep 19 01:42:26 2026 committer Chromium LUCI CQ Sat Sep 19 01:42:26 2026 [M154] Disable self-occlusion optimizations Original change's description: > Disable self-occlusion optimizations > > Self-occlusion optimizations are causing rendering issues for PWAs and > should be disabled. > > Bug: 557504547 > Test: unit tests, cq, manual occlusion test > Change-Id: Ia830d6428ce19ae3c431ebdaa8f962588031625f > Reviewed-on: > Auto-Submit: Kameron Lutes > Reviewed-by: Mitsuru Oshima > Commit-Queue: Kameron Lutes > Cr-Commit-Position: refs/heads/main@{#1700497} (cherry picked from commit e7e6f352a8759cea1bee2b6088433946483d7080) Bug: 563469403,557504547 Change-Id: Ia830d6428ce19ae3c431ebdaa8f962588031625f Reviewed-on: Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Bot-Commit: [email protected] Commit-Queue: David Stevens Cr-Commit-Position: refs/branch-heads/8037@{#1265} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} testing/variations/fieldtrial_testing_config.json [ diff ] ui/android/java/src/org/chromium/ui/base/UiAndroidFeatureList.java [ diff ] ui/android/ui_android_features.cc [ diff ]

testing/variations/fieldtrial_testing_config.json [ diff ]

ui/android/java/src/org/chromium/ui/base/UiAndroidFeatureList.java [ diff ]

ui/android/ui_android_features.cc [ diff ]

commit d68a4bd8be7ab0adeb3aa6a20ccf1ee2af234f44 author Dan Murphy Sat Sep 19 01:05:30 2026 committer Chromium LUCI CQ Sat Sep 19 01:05:30 2026 [M154] [JavaScript Dialogs] Fix Invalidate() potential UAF Original change's description: > [JavaScript Dialogs] Fix Invalidate() potential UAF > > When AppModalDialogManager::CancelDialogs() invalidates a queued dialog > (such as a beforeunload dialog), its DialogClosedCallback can > synchronously resume deferred operations (e.g. prerender activation) and > re-entrantly invoke CancelDialogs(). > > Closing the active dialog triggers ShowNextDialog() -> GetNextDialog(), > which drains and destroys all invalidated queued controllers from > AppModalDialogQueue, including the controller whose Invalidate() is > currently executing on the call stack. Accessing view_ after > CallDialogClosedCallback() then results in a potential use-after-free. > In addition, iterating AppModalDialogQueue directly in CancelDialogs() > causes circular_deque iterator invalidation when re-entrancy mutates the > queue. > > Similarly, AppModalDialogQueue::InvalidateAndClearQueuedDialogs() popped > dialogs one by one, allowing re-entrant ShowNextDialog() calls to drain > and destroy queued controllers while the loop was still walking them. In > NotifyDelegate(), valid_ was set to false at the bottom of the method, > leaving a window where synchronous callbacks could re-enter > NotifyDelegate() or Invalidate(). > > Fix this by: > > 1. Adding WeakPtrFactory to AppModalDialogController, checking weak_this > after CallDialogClosedCallback(), CompleteDialog(), and > ShowModalDialog() before accessing member variables, and invalidating > weak pointers at the start of ~AppModalDialogController(). > 2. Marking valid_ = false immediately at the top of NotifyDelegate() to > close the re-entrancy window. > 3. Snapshotting WeakPtrs into a local vector in CancelDialogs() before > calling Invalidate(), and re-fetching the active dialog afterwards. > 4. Moving queued dialogs into a local container before invalidating in > AppModalDialogQueue::InvalidateAndClearQueuedDialogs(), with an outer > while loop to catch dialogs enqueued during invalidation. > 5. Adding regression tests in app_modal_dialog_queue_unittest.cc > covering both CancelDialogs() and CancelAllDialogs() re-entrancy. > > TAG=agy > CONV=b95c3950-7b1c-4e87-bf3c-e8b6423aeef8 > > Fixed: 560439699 > Test: components_unittests --gtest_filter="AppModalDialogQueueTest.*" > Change-Id: Ic910991545fbb878b60fb3a0b5d8f48d1f98cfd0 > Reviewed-on: > Commit-Queue: Daniel Murphy > Reviewed-by: Avi Drissman > Cr-Commit-Position: refs/heads/main@{#1699065} (cherry picked from commit f96629e877623801b3dcb24453aee1ce15032465) Bug: 563219593,560439699 Change-Id: Ic910991545fbb878b60fb3a0b5d8f48d1f98cfd0 Reviewed-on: Commit-Queue: [email protected] Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Bot-Commit: [email protected] Cr-Commit-Position: refs/branch-heads/8037@{#1264} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} components/javascript_dialogs/app_modal_dialog_controller.cc [ diff ] components/javascript_dialogs/app_modal_dialog_controller.h [ diff ] components/javascript_dialogs/app_modal_dialog_manager.cc [ diff ] components/javascript_dialogs/app_modal_dialog_queue.cc [ diff ] components/javascript_dialogs/app_modal_dialog_queue_unittest.cc [ diff ]

components/javascript_dialogs/app_modal_dialog_controller.cc [ diff ]

components/javascript_dialogs/app_modal_dialog_controller.h [ diff ]

components/javascript_dialogs/app_modal_dialog_manager.cc [ diff ]

components/javascript_dialogs/app_modal_dialog_queue.cc [ diff ]

components/javascript_dialogs/app_modal_dialog_queue_unittest.cc [ diff ]

commit 32d4c9c135da9929a4a230a15786602b98622811 author Amya Singhal Sat Sep 19 00:34:49 2026 committer Chromium LUCI CQ Sat Sep 19 00:34:49 2026 [M154] [Dictation] Close UI on audio tokenizer timeout Original change's description: > [Dictation] Close UI on audio tokenizer timeout > > Simplest UI to handle timeout > > Bug: b:561673234 > Change-Id: I58a3915056b86311cecd30d01765fbf000de572e > Reviewed-on: > Reviewed-by: David Bokan > Commit-Queue: Amya Singhal > Cr-Commit-Position: refs/heads/main@{#1699747} (cherry picked from commit 1a8af4f95c6ee2b43f0b0ac3db866864a1ee17fb) Bug: 562921754,b:561673234 Change-Id: I58a3915056b86311cecd30d01765fbf000de572e Reviewed-on: Commit-Queue: [email protected] Bot-Commit: [email protected] Auto-Submit: chrome-cherry-picker@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/8037@{#1263} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chrome/browser/dictation/session_controller.cc [ diff ] chrome/browser/dictation/session_ui_impl_browsertest.cc [ diff ]

chrome/browser/dictation/session_controller.cc [ diff ]

chrome/browser/dictation/session_ui_impl_browsertest.cc [ diff ]

commit 9292f7d142d573e80e03fb75671a789a30aec031 author chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Sat Sep 19 00:05:06 2026 committer chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Sat Sep 19 00:05:06 2026 Incrementing VERSION to 154.0.8037.53 Merge-Approval-Bypass: Chrome release infra Change-Id: I4d4532d9184a0e1182b3bca11868a1973301213b Reviewed-on: Bot-Commit: chrome-official-brancher@chops-service-accounts.iam.gserviceaccount.com Cr-Commit-Position: refs/branch-heads/8037@{#1262} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chrome/VERSION [ diff ]

chrome/VERSION [ diff ]

commit c1c817ed84eec8c1e3571e9f9c7e71f73c8bf472 154.0.8037.52 author Ahmed Raslan Fri Sep 18 23:17:05 2026 committer Chromium LUCI CQ Fri Sep 18 23:17:05 2026 Gardener: Disable HistogramsInternalsUIBrowserTest.RefreshHistograms on Linux This test is flaking and bringing down gardened Linux builders. Disabling on Linux only to preserve coverage on other platforms. SKIP_DISABLING_SUITES_CHECK: Gardener disabling flaky test to fix the tree. NOTREECHECKS=true NOTRY=true (cherry picked from commit 38bed0ae74f6432ff9a05db56e420eb3eba345ae) Bug: 543826418 Change-Id: I0a21daeaa11782e41c7a8e4275a75c2214b70b5d Reviewed-on: Reviewed-by: Ahmed Raslan Owners-Override: Ahmed Raslan Commit-Queue: Michał Kaczmarczyk Reviewed-by: Anatoli Hancharou Reviewed-by: Michał Kaczmarczyk Auto-Submit: Ahmed Raslan Reviewed-by: Aliaksei Bahdzevich Cr-Original-Commit-Position: refs/heads/main@{#1690661} Merge-Approval-Bypass: [Gardener] Disable failing test Reviewed-on: Commit-Queue: Ahmed Raslan Auto-Submit: Robert Liao Owners-Override: Robert Liao Cr-Commit-Position: refs/branch-heads/8037@{#1261} Cr-Branched-From: e10b20e60f162e7ad88e4930833695a54f4e15fb-refs/heads/main@{#1689415} chrome/test/data/webui/histograms/histograms_internals_browsertest.cc [ diff ]

chrome/test/data/webui/histograms/histograms_internals_browsertest.cc [ diff ]

commit c4b23399456654fa8505d138d448a9f7824b7510 author Hiroki Nakagawa Fri Sep 18 22:49:51 2026 committer Chromium LUCI CQ Fri Sep 18 22:49:51 2026 [Gardener] Disable ReadAnythingMochaTest.RectCalculations on Windows Disable ReadAnythingMochaTest.RectCalculations on Windows due to flakiness. SKIP_DISABLING_SUITES_CHECK=true TAG=agy CONV=4433a01f-bf4e-4f8e-bfe0-d3fe73f8e416 (cherry picked from commit 5ccbc3c507dc97603233f658fd77edb284485cd3) No-try: true Bug: 502069860 Change-Id: I09ccf83040fcbc1ff1e6fdd827c5d125ab0bf36a Reviewed-on: Reviewed-by: Kentaro Hara Owners-Override: Hiroki Nakagawa Auto-Submit: Hiroki Nakagawa Commit-Queue: Hiroki Nakagawa Cr-Original-Commit-Position: refs/he...