)]}' { "log": [ { "commit": "a572625cb5090f73bda24fb36c84bba1eaa63b49", "tree": "57c24922419e533f18cf58df6271f759ca81787a", "parents": [ "37879b565bbd0749062156c67673e5755cac9464" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Wed Sep 02 05:38:59 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Sep 02 05:42:55 2026" }, "message": "[PA] Replace largest_active_bucket_index_ with active_bucket_count_\n\nThis CL renames `largest_active_bucket_index_` to `active_bucket_count_`\nin `ThreadCache` and `ThreadCacheRegistry`, and optimizes hot-path\nvalidity and bucket bounds checks in PartitionAlloc (`bucket_index \u003c\ntcache-\u003eactive_bucket_count()`).\n\nThis makes use of zero-initialized `ThreadCache` safer - it simply\ndenotes there is no active bucket and routes every allocation to the\nglobal root instead.\n\nTAG\u003dagy\nCONV\u003d80980e77-c356-4c8b-a00b-3a2c47533fbb\n\nChange-Id: Ie599f94695b8f5d1662da26f5efd2ad9fa6b021a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8254723\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1690469}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 75f790d6fca4e88282c5d68c8f0faa40c45022c7\n" }, { "commit": "37879b565bbd0749062156c67673e5755cac9464", "tree": "b51cd916354274e4360373717cb2cf8259b1531e", "parents": [ "c029851c21b7e1154fa3964e08c97710adc92cc7" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Tue Sep 01 20:45:21 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 01 20:49:52 2026" }, "message": "Spanification of partition_alloc_base/files/file_util.h\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 505042664\nChange-Id: I54710bea524e4ae5f38dfe201775e22fdf123d6a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7834023\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1690083}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5c6fb26e6d58c1a3ef7890d0115610e99a327245\n" }, { "commit": "c029851c21b7e1154fa3964e08c97710adc92cc7", "tree": "89baae34837db5e2026089887bd6cc2fabd2853c", "parents": [ "fa8d9a4fb4ca3af310cc5826b8cc15047e6506f3" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Tue Sep 01 03:34:14 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 01 03:39:43 2026" }, "message": "[PA] Make SlotStart family aggregate types\n\nUnder the MSVC x64 ABI, user-defined types (even if \u003c\u003d 8 bytes) are not\nreturned in %rax if they possess user-declared constructors or private\nnon-static data members. Instead, MSVC passes a hidden return pointer in\n%rcx (sret), shifting all parameters by one register and forcing a stack\nbuffer allocation, memory write, and memory reload on every function\nreturn.\n\nBy making the address_ member public and removing user-declared\nconstructors (allowing the compiler to implicitly generate default\nconstructors and enabling aggregate initialization), SlotStart,\nSlotSpanStart, and UntaggedSlotStart become standard-layout aggregates.\nUnder MSVC x64, functions returning SlotStart now return directly in\n%rax without any hidden return pointer or stack slot indirection.\n\nTAG\u003dagy CONV\u003da2a703a3-6e04-439a-828c-c3acc7324bd0\n\nChange-Id: Ib61d2d58c0df5738666f36ef1ac8e2789f46c74c\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8333627\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1689593}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 54228d3ca16a4164d3860c2dd9a83c670e1b443c\n" }, { "commit": "fa8d9a4fb4ca3af310cc5826b8cc15047e6506f3", "tree": "029452fc58d7e1b652c5bb8eddc37090bf8360da", "parents": [ "eba8297f08e73f28789b4119b72760730967e2d5" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Tue Sep 01 02:57:02 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 01 03:02:11 2026" }, "message": "Spanification of partition_alloc_base/strings/safe_sprintf_pa_unittest.cc\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 505042664\nChange-Id: Ic69a1d6adb9fc76668ebe1c1f6ca4e4d835239b8\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7833749\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1689565}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 0b86d7379f878a9f2ef57bf64326e99a2b9daa3d\n" }, { "commit": "eba8297f08e73f28789b4119b72760730967e2d5", "tree": "639e9f9fb58dadbe1dd43bb232561ee8c046ca3c", "parents": [ "89615a645f0220fb03875111c2d9ae4dea9887d8" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Tue Sep 01 00:04:37 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Sep 01 00:08:54 2026" }, "message": "Spanification of partition_alloc_base/posix/safe_strerror.cc\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 505042664\nChange-Id: I98ca0d14df25278bc980aa31ad546392c4ee2488\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7834548\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1689424}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ceaf0dae1e2fff8c957fc0a6ea02cec3b049950c\n" }, { "commit": "89615a645f0220fb03875111c2d9ae4dea9887d8", "tree": "cbfafe785d9c34a25e2e1725c30dc94ea82d871c", "parents": [ "a1cd1335c8a860ac622b4b9686f43bd1ff68dcd5" ], "author": { "name": "Takashi Sakamoto", "email": "tasak@google.com", "time": "Mon Aug 31 09:51:58 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Aug 31 09:56:16 2026" }, "message": "PA: Make SchedulerLoopQuarantineBranch use `enum class QuarantineTarget`\n\nChange the type of the second template parameter of\n`SchedulerLoopQuarantineBranch` from `bool` to `enum class\nQuarantineTarget`.\n\nquarantine, and QuarantineTarget::kSanitizedObject is for AdvancedMemorySafteyChecks-macro based quarantine.\n\nQuarantineTarget: :kMiracleObjects is for task-scheduler aware\nChange-Id: I882abec82fb41eda123ecfc056a32cb8a348b8f1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8294538\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1688923}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e2c6d7b3c116e04524baaef274ec965a63739055\n" }, { "commit": "a1cd1335c8a860ac622b4b9686f43bd1ff68dcd5", "tree": "87c11784964157b8ae97acb06c24f50d0de90a15", "parents": [ "649c2cda65039d9ef85d816f0d46e9ef5d23d207" ], "author": { "name": "Keishi Hattori", "email": "keishi@google.com", "time": "Mon Aug 31 08:41:35 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Aug 31 08:46:08 2026" }, "message": "[PA] Derive intended-leak behavior from the owning root\n\nAllow PartitionRoot to be configured with\nPartitionOptions::intended_leak, mirrored into Settings. When enabled,\nany allocation freed through PartitionAlloc (including free(),\nsized/aligned delete, and realloc copy-then-free) is automatically\nsanitized and leaked in RawFreeWithThreadCache() after the ThreadCache\ndeallocation path.\n\nEnforce invariant checks that thread_cache and BRP cannot be enabled on\nan intended-leak root both during PartitionRoot::Init() and within\nPartitionRoot::EnableThreadCacheIfSupported().\n\nConfigure the allocator shim\u0027s intended leak root with intended_leak \u003d\nkEnabled.\n\nBug: 546295511\nChange-Id: I41dd987d1d61853a7b999fd3ee0cfdda3bb2d68a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8256709\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1688890}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 299f6bb2b1b02ce86ed49cffd591fe3cdb46c355\n" }, { "commit": "649c2cda65039d9ef85d816f0d46e9ef5d23d207", "tree": "06caed286de8f63dfee0c333ac095074fc5e467c", "parents": [ "f0d1e646eb41d8736261d5d8d8f094404bac62ac" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Mon Aug 31 06:56:27 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Aug 31 07:01:12 2026" }, "message": "[PA] Consolidate PartitionAlloc TLS into a single structure.\n\nThis CL renames partition_tls.h to tls.h and defines a single\n`PartitionTls` structure that holds all thread-unique objects used\nwithin PartitionAlloc. Specifically, it now holds the ThreadCache\npointers and the disallow_allocations flag.\n\nThis consolidation reduces TLS slot usage and minimizes code\nduplication. TLS creation remains non-allocating.\n\nTo minimize overhead on allocation and deallocation hot paths:\n- Placed scalar flags at byte offset 0 of struct PartitionTls for\n D-cache locality.\n- Combined thread cache validity and bucket size checks into a single\n branch (bucket_index \u003c thread_cache-\u003eactive_bucket_count()) on hot\n paths, removing duplicate checks and redundant TLS lookups.\n\nTAG\u003dagy\nCONV\u003d80980e77-c356-4c8b-a00b-3a2c47533fbb\n\nBug: 329027914\nChange-Id: If05f8f540281a135eba36aba872df424a4c208be\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8264055\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1688851}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 67b58121286da3189afe0e05570f4e0c70499cf8\n" }, { "commit": "f0d1e646eb41d8736261d5d8d8f094404bac62ac", "tree": "d23874cdf642bc0caf3a89d7fb5017cea9520778", "parents": [ "1f5d57db1b2c9dfcb5cabca3ec879fbe39f21619" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Mon Aug 31 03:16:21 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Aug 31 03:19:58 2026" }, "message": "[PA] Move SlotStart out of internal namespace\n\nExpose (Untagged)SlotStart in partition_alloc namespace as part of the\npublic API, given that those types are used by external components like\nGWP-ASan.\n\nTAG\u003dagy\nCONV\u003d752bd6a5-c227-42f7-abbe-f4394e8f914f\n\nBug: 553258782\nChange-Id: Ifb98335c21197731a2b7d9baa0f64a4ab9657fed\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8303792\nReviewed-by: Sergei Glazunov \u003cglazunov@google.com\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1688806}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a8ce70df9da4d58740e4581d61d1bb5bcaae205a\n" }, { "commit": "1f5d57db1b2c9dfcb5cabca3ec879fbe39f21619", "tree": "5d6b4ff0e42fa18e39dfba3fb1a342cdc5041cf6", "parents": [ "15bf773bf769a1255068b31ecf5cddca3c86ffd8" ], "author": { "name": "ainozaki", "email": "ainozaki@google.com", "time": "Fri Aug 28 08:54:23 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 28 08:58:30 2026" }, "message": "[PA] Support maximum AllocToken IDs\n\nCurrently, the maximum number of AllocToken IDs is set to 2.\nThis CL increases it to the maximum supported value (SIZE_MAX).\n\nBug: 549500187, 549496291, 477186304\nChange-Id: I98426ac4141793ccc25f3c32e8e5b3a91b3640af\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8284578\nReviewed-by: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nCommit-Queue: Ai Nozaki \u003cainozaki@google.com\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1687857}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 825e8de34d6b24acde630f14f7b99c3d72d9ad21\n" }, { "commit": "15bf773bf769a1255068b31ecf5cddca3c86ffd8", "tree": "ffa6c82f71c6eb6cf9c35ef9406943c96383d284", "parents": [ "876243f2898c59de983673645438d61f794680e5" ], "author": { "name": "ainozaki", "email": "ainozaki@google.com", "time": "Fri Aug 28 08:18:49 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 28 08:25:30 2026" }, "message": "[PA] Decouple AllocToken from partition index\n\nCurrently, the AllocToken is used directly as the partition index.\nHowever, as upcoming work, we plan to increase the maximum number of\nAllocTokens from 2 to 2^32-1.\n\nTo prepare for this change, this CL decouples them in both directions:\n(1) AllocToken -\u003e partition index mapping: Introduces a mapping function (`PartitionIndexFromAllocToken`) to resolve the partition index from an AllocToken.\n(2) Partition index -\u003e AllocToken mapping: Defines a dedicated default value `kDefaultAllocTokenValue` instead of using `kDefaultPartitionIndex` for default AllocToken value.\n\nBug: 549500187\nChange-Id: Ib2201c6202c6a0211253dbe8fd948c133dcb2ecf\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8264052\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Ai Nozaki \u003cainozaki@google.com\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1687842}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2cbf35b67a1f0dafa4ff675ed404af0d5b2791ff\n" }, { "commit": "876243f2898c59de983673645438d61f794680e5", "tree": "86cb198ff491f3192715b3559319b7d0a1ecfa19", "parents": [ "21aca3fea44602829331cadec6a94364d3edcb52" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Fri Aug 28 07:05:40 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 28 07:14:06 2026" }, "message": "[PA/MO] Add an option to apply quarantine only to IPC-triggered tasks\n\nGiven that IPC-triggered tasks may contain web-controlled behavior,\nwe would like to have a configuration to perform quarantine only in such\ncondition.\n\nTAG\u003dagy\nCONV\u003d958945a5-4b47-4611-afe0-c9f4fbee0c41\n\nBug: 329027914\nChange-Id: Ib31921cc233f1cbbc7e9b1c200dcf8a5239da9bf\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7863493\nReviewed-by: Gabriel Charette \u003cgab@chromium.org\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1687816}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 47e308465ac27fd17708b23ce753bb3fd75a20f3\n" }, { "commit": "21aca3fea44602829331cadec6a94364d3edcb52", "tree": "4014293499a53c31348bb0305e18731e3201b226", "parents": [ "990382a359fd577b9cb92d4aa205993a80690813" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Fri Aug 28 06:38:47 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 28 06:42:56 2026" }, "message": "PA: Remove `base/augmentations/`\n\nThis isn\u0027t really necessary. Remove the directory, the reference in the\n`README.md`, and merge the non-null attribute into the main body of\n`compiler_specific.h`.\n\nWhile we\u0027re at it, update `compiler_specific.h` with the canonical\n`//base` copy. Note that a few entries are exclusive to ours:\n\n* `PA_EXCLUDE_FROM_EXPLICIT_INSTANTIATION` and\n* `PA_NOPROFILE`\n\nReviewing notes:\n* patchset 1: informational dump of `base/compiler_specific` into\n `partition_alloc_base/`.\n* patchset 2: first draft, copying everything and prefixing `PA_`\n everywhere.\n* patchset 3: remove unused things to almost satisfy the compile size\n checker.\n\nThis CL was generated with Jetski.\n\nCompile-Size: We prefer not to strip all comments from this header.\nChange-Id: If9fa1076df7ef429562eaf1cffd4da881c8584f9\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8302474\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1687809}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7f2ec1d6e864cdcc5a2818726656b28e322ec140\n" }, { "commit": "990382a359fd577b9cb92d4aa205993a80690813", "tree": "f742dce16a0dcff22f69565e9a4f268c3d6efe24", "parents": [ "e4d2f0370f1a10092bb5b025e9e2dd9c7a904881" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Fri Aug 28 04:42:03 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 28 04:47:20 2026" }, "message": "Prevent a realloc slot reuse with live raw_ptr refs\n\nPreviously for allocations that requested a new smaller size, we\nwouldn\u0027t look at the value of the ref count of BRP. This means that if\nwe decided to reuse the slot all the raw_ptrs remain valid and pointing\ninto the slot.\n\nHowever this could mean for slots both slots that can_store_raw_size or\neven regular slots that get realloc\u0027d for a new purpose, that the old\nraw_ptrs could still be accessed essentially allowing a UaF because they\ndidn\u0027t properly quarantine.\n\nWe fix this by checking the ref count and rejecting in place realloc if\na raw_ptr is alive and pointing to this slot (we can continue to realloc\nif there are no raw_ptr referencing this slot).\n\nTwo regression tests are added one for direct map and one for thread\ncache level allocations.\n\nBug: 549709219\nChange-Id: I031eebc435f452626a285ca14d9ff361aebd530e\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8294158\nCommit-Queue: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1687767}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e5b9eae52a251d6c1b499b7e33f99ab15484f48d\n" }, { "commit": "e4d2f0370f1a10092bb5b025e9e2dd9c7a904881", "tree": "c0ad9a02940333d01375dc11832145d371da3807", "parents": [ "b49162b4623586983e6543c187a739e2ef2ea1d6" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Thu Aug 27 08:22:32 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Aug 27 08:29:51 2026" }, "message": "ReallocProtectedIterator: Use `std::optional`\n\nAs a follow-up to https://crrev.com/c/8276244,\navoid using the default-constructed\n`partition_alloc::SlotAddressAndSize` (all zeros) as a sentinel value;\nexplicitly use `std::nullopt` to cover these cases.\n\nNote that `SlotAddressAndSize::From()` is never expected to return 0\u0027s;\nthis CL simply covers the case where we would deliberately want to\ndenote \"no value stored in `slot_`\".\n\nChange-Id: I61528313eb30159959acdb3db876751f68c64f43\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8295498\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1687034}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: dc71c83a5fb4ae67622617142765e3356a8c7e69\n" }, { "commit": "b49162b4623586983e6543c187a739e2ef2ea1d6", "tree": "912e8359bc6f68928c50a1538d9e74f9f0ce53f6", "parents": [ "f755cc4b658352715cf5280f5d14510200f5dc39" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Thu Aug 27 08:22:15 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Aug 27 08:29:13 2026" }, "message": "PA: Adjust args to `FreeAfterBRPQuarantine()`\n\nFurther propagate `SlotAddressAndSize` for improved ergonomics.\n\nChange-Id: I554ab45de97c0662362b3d63ed147e6c68400324\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8282223\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1687033}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: c52f709dfb70db4cadc92379b17294b3056a142e\n" }, { "commit": "f755cc4b658352715cf5280f5d14510200f5dc39", "tree": "c816df9624062bfc6922d3c1fe8eba00b897ab5e", "parents": [ "d9b0e26a791f3c8c01ad7eec028bff6b30f5f1bc" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Thu Aug 27 08:15:42 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Aug 27 08:25:59 2026" }, "message": "PA: Introduce `InSlotMetadata::From()`\n\nto replace `PartitionRoot::InSlotMetadataPointerFromSlotStartAndSize()`,\nwe introduce a static getter that directly accepts a\n`SlotAddressAndSize`.\n\nThis CL was generated with Jetski.\n\nChange-Id: I2ae4fbaf1e204d5b2d74a3b123308505e77b169a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8279193\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1687027}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e1ada26e7dbef7721504912c22cdb4872c2bfbd6\n" }, { "commit": "d9b0e26a791f3c8c01ad7eec028bff6b30f5f1bc", "tree": "1cb0c1cb780dc1e740e03132c7340492005d7d5d", "parents": [ "46c370799fc1274f0bb0393abed545e57a482027" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Thu Aug 27 08:13:17 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Aug 27 08:18:11 2026" }, "message": "ReallocProtectedIterator: Use PA struct\n\n`internal::WrappedBackingSlot` has (semantically) the same members as\n`partition_alloc::SlotAddressAndSize`, plus an extra `explicit operator\nbool()` used just once in the implementation.\n\nThis CL removes the indirection by just using `SlotAddressAndSize`\ndirectly, preventing the shucking/repacking cycles.\n\nThis CL was generated with Jetski.\n\nChange-Id: Iff3cee6afeeab897b80a5913150898e7d7416ebe\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8276244\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1687026}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e7a328068e889f855ecf1d0e2e89c23e8e098bd3\n" }, { "commit": "46c370799fc1274f0bb0393abed545e57a482027", "tree": "f7cd22bb4d2f6005ab021b411e69250cae99dd4e", "parents": [ "940e80830ad7b176f7b5ef129ca2683006fb4c7e" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Wed Aug 26 21:46:50 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 26 21:52:54 2026" }, "message": "Spanification of shim/allocator_shim_default_dispatch_to_partition_alloc.cc\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 505042664\nChange-Id: Ife8725bd3163241e381f110b48e320591101610d\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7828614\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1686718}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 451f93fedef087e522c3545ba420b766843cf747\n" }, { "commit": "940e80830ad7b176f7b5ef129ca2683006fb4c7e", "tree": "3ada05a499cd3cd4cc37ecc0e5a71e8d79e63619", "parents": [ "335d95e22df3c488f57bec38cf22327076b3da28" ], "author": { "name": "Justin Cohen", "email": "justincohen@google.com", "time": "Wed Aug 26 15:53:50 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 26 16:02:13 2026" }, "message": "base: Remove CheckHeapIntegrity and CheckMetadataIntegrity\n\nThe last caller of base::CheckHeapIntegrity has been removed. This CL\nremoves base::CheckHeapIntegrity, base::allocator::CheckHeapIntegrity,\nand partition_alloc::PartitionRoot::CheckMetadataIntegrity.\n\nStatic analysis of callers of corrupted memory proved to be a more\neffective approach for debugging `free()` issues.\n\nBug: None\nChange-Id: Ic707fe5488b6cca7c4aad587e0426fd90e18689f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8276173\nAuto-Submit: Justin Cohen \u003cjustincohen@google.com\u003e\nCommit-Queue: Justin Cohen \u003cjustincohen@google.com\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Kyle Charbonneau \u003ckylechar@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1686428}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f4220d71a741e49ff44f5f6d6ce3a9c612538c52\n" }, { "commit": "335d95e22df3c488f57bec38cf22327076b3da28", "tree": "58ae49917aea620aa08cf8e67505a06938375bde", "parents": [ "bda1ae135a6d92ebe80646334c275865f0cba60b" ], "author": { "name": "Gregg Tavares", "email": "gman@google.com", "time": "Tue Aug 25 08:16:03 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Aug 25 08:20:19 2026" }, "message": "PAlloc: Use less space for power-of-2 sized AlignedAlloc.\n\nBefore this change, when working with AlignedAlloc we will\nrounded up to the next power of two, this sadly had a bad\nconsequence when the size itself is a power of two. Given\nthat in most Partitions PartitionAlloc has to store the\ninline metadata as well, this will make the size be just\never so slightly larger than a power of two, and then we\u0027d\nwaste basically double the requested size.\n\nThis CL fixes it to just round up to the alignment size\nafter adding space for the metadata.\n\nNote: There was a comment to the effect of:\n\n// PartitionAlloc only guarantees alignment for power-of-two\n// sized allocations.\n\nThat comment was a little off. Within a bucket, every allocation is\naligned to that bucket\u0027s slot size.\n\nBug: 491627887\nChange-Id: I250bf9eb645717eccf98db15d37f0a206a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8273137\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Gregg Tavares \u003cgman@chromium.org\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1685354}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: d44365c54646dfab8693c578e9ac435bf807b8d4\n" }, { "commit": "bda1ae135a6d92ebe80646334c275865f0cba60b", "tree": "a53bc295bf5f90619277ab1552eb065828e15720", "parents": [ "0e3ace2c8ef1de7744471ee348e9e8d261671842" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Tue Aug 25 07:31:37 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Aug 25 07:37:04 2026" }, "message": "PA: Mark `GetSlotUsableSize()` `const`\n\nAlso, move the two-argument version closer to the one-argument version,\njust to make it more obvious they are both implemented in\n`partition_root_internal.h`.\n\nChange-Id: I825fd0d019117f8896952414ca0e4ed5cf61e267\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8282557\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1685306}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2c82d0992ff313afaafaec8d1a3b6f1447b223f5\n" }, { "commit": "0e3ace2c8ef1de7744471ee348e9e8d261671842", "tree": "74c2a5add89747520228bdf25f2e14cbfa599162", "parents": [ "2f810de7fd542c8b19cce6f0eab6b87996ba005e" ], "author": { "name": "Arthur Sonzogni", "email": "arthursonzogni@chromium.org", "time": "Mon Aug 24 15:34:34 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Aug 24 15:39:45 2026" }, "message": "[PA] Add support for operator new(std::align_val_t, std::nothrow)\n\nPartitionAlloc previously routed operator new with alignment and\nstd::nothrow to ShimCppAlignedNew, which invoked alloc_aligned_function\nand entered the new handler loop on OOM rather than returning nullptr.\n\nThis adds alloc_aligned_unchecked_function to AllocatorDispatch and\nroutes nothrow aligned new calls to ShimCppAlignedNewNoThrow, returning\nnullptr on allocation failure. It also ensures AlignedAlloc handles\nexcessive allocation sizes gracefully on 32-bit platforms.\n\nFixed: 507484971\nChange-Id: I24b89326e6435c2491a9235d97f37476ce1e9e3b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8265210\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Sergei Glazunov \u003cglazunov@google.com\u003e\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCommit-Queue: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1684779}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 1f31d1914426758a4625585a419ce0064aece98d\n" }, { "commit": "2f810de7fd542c8b19cce6f0eab6b87996ba005e", "tree": "87c3991e77683a6ff84a377afa5e2261d2de4bcc", "parents": [ "df5fc1b01c7e81ed1396ea140b9ff07e6eb90536" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Mon Aug 24 13:00:55 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Aug 24 13:06:53 2026" }, "message": "PA: Directly call `GetRawSize()`\n\nIn `PartitionPurgeSlotSpan()`, we can call `GetRawSize()` rather than\n`GetUtilizedSlotSize()`, conditioned on the slot span having the raw\nsize available.\n\nChange-Id: I54e73cc52390f3a953ddcc72468a72640e72fbd4\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8277509\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1684709}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: d49a3af581d7f4107fb13b5d97d188f8df4156a2\n" }, { "commit": "df5fc1b01c7e81ed1396ea140b9ff07e6eb90536", "tree": "d53f4d6d168dca2277e054fff0acf0e8c835dfb0", "parents": [ "7dbf24ac4ecfb1c687d95e17e61f32191af1f000" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Mon Aug 24 08:23:40 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Aug 24 08:27:56 2026" }, "message": "PA: Include buildflags header\n\nIWYU per the style guide. `PA_BUILDFLAG()` requires\n`partition_alloc/buildflags.h`.\n\nChange-Id: I11d1fbb519105166d93697e7c3e2d977eda84079\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8276949\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1684629}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: b74f446be6bc7003ba70df4fc48f703dcf0b51cf\n" }, { "commit": "7dbf24ac4ecfb1c687d95e17e61f32191af1f000", "tree": "16b41004d50553d5df65e309959df01fed1d03cc", "parents": [ "ac51e08318fccba87b45ec7b0c2382309640c904" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Fri Aug 21 16:01:23 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 21 16:06:09 2026" }, "message": "Remove UNSAFE_TODO from partition_alloc/scheduler_loop_quarantine_support.cc\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 505042664\nChange-Id: Ideb834e06b6b8ed5ac6d9e35e04c2fcadab1114b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7834102\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1683937}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 6a031af089b9692f4e616d81ba42b1e1d408fd67\n" }, { "commit": "ac51e08318fccba87b45ec7b0c2382309640c904", "tree": "49ab51a648bac970882fdb93fa2cdb287b6f3b67", "parents": [ "f37e5dd97cd38300877ad1b53933417fb4682fb8" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Fri Aug 21 14:21:34 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 21 14:26:38 2026" }, "message": "remove UNSAFE_TODOs from partition_alloc/partition_root.cc\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 505042664\nChange-Id: I839fd0af91a0ba601ccf13d4a3b206f274afa0e4\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7833803\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1683884}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2ab8c8090931ee114af1bac6ac3f4804a3f0b6e4\n" }, { "commit": "f37e5dd97cd38300877ad1b53933417fb4682fb8", "tree": "3ee37950acb9ebc4dc4602c41dc2d9457a15ebb2", "parents": [ "087e4c38b0e7e129a033559f5de82c619fd8dc60" ], "author": { "name": "ainozaki", "email": "ainozaki@google.com", "time": "Fri Aug 21 07:25:26 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 21 07:31:41 2026" }, "message": "[PA] Switch AllocToken ABI from Fast ABI to non-Fast ABI\n\nCurrently, AllocToken uses Fast ABI, which embeds the token ID directly\ninto the allocation function names (e.g., `__alloc_token_0_malloc`).\nThis approach is efficient while the number of AllocTokens is small\n(currently fixed at 2).\n\nHowever, in upcoming work, we plan to scale the number of AllocTokens up\nto 2^32 - 1 to leverage AllocToken for smart sampling (e.g.,\nGWP-ASan) and for zapped memory to enhance post-crash debuggability. When scaling up the number of AllocTokens, embedding IDs into function\nnames would lead to severe binary size expansion. Passing the ID as a\nfunction argument (non-Fast ABI) is more scalable.\n\nThis CL switches the AllocToken ABI from Fast ABI to non-Fast ABI by\nupdating the build flags, symbol entry points, and linker map\nconfigurations.\n\nChange-Id: Ie72d8bd8aa2fbed4b67b3846b4d92cc461e5b895\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8257195\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Ai Nozaki \u003cainozaki@google.com\u003e\nReviewed-by: Takuto Ikuta \u003ctikuta@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1683729}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 4cbbbd07dd4a48518181e3ea640cb63a3fc7518c\n" }, { "commit": "087e4c38b0e7e129a033559f5de82c619fd8dc60", "tree": "01b4aea898398998d84a2506c7d1b9e7f5e05a25", "parents": [ "584ccf1ce5c6b7bb78378d9bf2962a389db0413d" ], "author": { "name": "Keishi Hattori", "email": "keishi@google.com", "time": "Fri Aug 21 07:16:55 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 21 07:21:16 2026" }, "message": "[PA] Zap intended leaks even without a type id hint\n\nIn FreeNoHooksImmediateInternal, hoist the zap logic out of the\nkWithTypeIdHint branch so that Free\u003ckIntendedLeak\u003e sanitizes the\npayload even when no type ID hint is passed by using\nkIntendedLeakUnknownTypeId.\n\nThis is necessary for RuntimeTargetedHardening where deallocations happen\nthrough ordinary free() without a known type ID hint at the free site,\nensuring retired slots are sanitized rather than left readable by\ndangling references. Existing callers (AMSC) always pass a hint and\nremain bit-identical in behavior.\n\nBug: 546295511\nChange-Id: Ib2b5769998fddb729ae04aec99e842ef7304fc44\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8256689\nCommit-Queue: Keishi Hattori \u003ckeishi@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1683725}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5e3372305c54756cb103ad016ba4ba9378446508\n" }, { "commit": "584ccf1ce5c6b7bb78378d9bf2962a389db0413d", "tree": "cdc6f9d56fb070270ba71999a08b56d7330640f3", "parents": [ "a80690fa5b8b7db617c2d7b3b3b4ea317998ada4" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Thu Aug 20 20:27:06 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Aug 20 20:30:51 2026" }, "message": "Spanification of shim/allocator_shim_default_dispatch_to_partition_alloc.cc\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 505042664\nChange-Id: I2d96621a653fd4e7ce0e78713e2b065b193c6808\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7834107\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1683393}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 54efe34a91f379fd1c85a676f69aaf26545ad717\n" }, { "commit": "a80690fa5b8b7db617c2d7b3b3b4ea317998ada4", "tree": "b002f5b6ff70dd497d5cf8096016ac00cdd3b4f1", "parents": [ "4abc0f4113903fbff2176c2367c9c0ea76166c2c" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Thu Aug 20 11:51:16 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Aug 20 11:56:31 2026" }, "message": "Spanification of partition_alloc/thread_cache_unittest.cc\n\nThis is the result of running the automatic spanification on linux\nand updating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 505042664\nChange-Id: I199570689a9bedee4d0a0e5b2a7abf968c5758c3\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7834103\nCommit-Queue: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1683044}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e3a262268c5a63cdff4ef7ec2ba8a3adcfe067fe\n" }, { "commit": "4abc0f4113903fbff2176c2367c9c0ea76166c2c", "tree": "62a69b7194f7c18c072c4295ea910bec9462461b", "parents": [ "b40bacc8b09953dc7a59a708251f214c6ab9eacb" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Thu Aug 20 11:38:28 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Aug 20 11:43:17 2026" }, "message": "Spanification of partition_alloc/thread_cache.cc etc.\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 505042664\nChange-Id: I035fd45f9bf187840df957823ef8658d0ed1f45e\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7833827\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1683038}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: dec4fbcb823940c41e44ae993d2cd69ec44246c8\n" }, { "commit": "b40bacc8b09953dc7a59a708251f214c6ab9eacb", "tree": "0ab3878b6bc8315661707cfa0716d9e4a4c860d7", "parents": [ "552529c4cee711d3e72841bda206e1b5e63f4cb4" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Wed Aug 19 15:56:25 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 19 16:00:50 2026" }, "message": "Spanification of partition_alloc/internal/thread_cache_internal.h, etc.\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 505042664\nChange-Id: I2bcbf6217d7fc0d8491f8a19f3746f3828405aa4\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7832915\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1682358}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a9fa5d69192a8576ddaaa4a6096c4e8c6f12a74f\n" }, { "commit": "552529c4cee711d3e72841bda206e1b5e63f4cb4", "tree": "4dbe752fe4c00288c3b7b9e6738d17aa83ac7cab", "parents": [ "5026491d64b68dfcba9e77333aa37a90804b76d9" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Wed Aug 19 15:36:37 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 19 15:40:28 2026" }, "message": "Spanification of partition_alloc/partition_alloc_base/rand_util_pa_unittest.cc\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 505042664\nChange-Id: I73f849b0fd979dd48d7b714ea9a441880741c974\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7833739\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1682336}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2671309d388796e98740a7c06ad28062a74b3534\n" }, { "commit": "5026491d64b68dfcba9e77333aa37a90804b76d9", "tree": "b604bf123a2d0de24b88781c10a6e5b431baa502", "parents": [ "85f6a439e6760020f6460d237ec4771467ff3ebd" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Wed Aug 19 15:35:45 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 19 15:39:40 2026" }, "message": "Spanification of partition_alloc/address_space_randomization_unittest.cc\n\nThis is the result of running the automatic spanification on linux\nand updating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 505042664\nChange-Id: Ic30f2e7b0b26a134d282e369cd40605df36ba47c\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7834110\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1682335}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 14dfa1988a21fd39ddb77e15328f0c97f2125472\n" }, { "commit": "85f6a439e6760020f6460d237ec4771467ff3ebd", "tree": "6d555585d5d2807f2cba17e92979ee2e86fede32", "parents": [ "89acd0d35ed7fb10563f4e8c70b4a37de2254d16" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Wed Aug 19 08:34:32 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 19 08:40:33 2026" }, "message": "Reserve a bit in `InSlotMetadata`\n\nThis CL supports Checked Span by reserving a bit in `InSlotMetadata` to\ndenote whether or not the original requested size (~3 bytes) is present\nat the end of the slot (before `InSlotMetadata`).\n\nThis bit currently serves no purpose. This CL should be reverted if we\nsee crashes from MiraclePtr refcount overflow, i.e. if the `PA_CHECK()`\nin `Acquire()` fires (implying that somebody is minting [(1 \u003c\u003c 29) - 1]\n\u003d\u003d 536 million `raw_ptr`s somewhere).\n\nBug: 534387022\nChange-Id: I2973514562d1b443bce3705622b698be7ce7a875\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8084483\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1682114}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 6ecbfb07b8f5b88aaa4b84429683ae42d34dfab8\n" }, { "commit": "89acd0d35ed7fb10563f4e8c70b4a37de2254d16", "tree": "d9a72e52611deafe84001a83b8a8e190ca9f3e65", "parents": [ "68b7f622cd9a30b2b3d77b42a9cd50abf655e142" ], "author": { "name": "Keishi Hattori", "email": "keishi@google.com", "time": "Wed Aug 19 06:50:52 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 19 07:00:10 2026" }, "message": "[PA] Move the intended-leak root into the allocator shim\n\nExpose an IntendedLeakAllocator() accessor from the PartitionAlloc\nallocator shim and from advanced memory safety checks.\n\n- Provides IntendedLeakAllocator() in allocator_shim_default_dispatch_to_partition_alloc.{h,cc} and in advanced_memory_safety_checks.cc.\n- Adds test coverage in AllocatorShimTest.IntendedLeakAllocator verifying that the intended leak root differs from the general-purpose malloc roots.\n\nBug: 546295511\nChange-Id: I553e256bd9b8040bf30e7d3dc896b2d256fd4903\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8255630\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Keishi Hattori \u003ckeishi@chromium.org\u003e\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1682073}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: bf969a22f49ad6ec33abb62410e24b9191f51687\n" }, { "commit": "68b7f622cd9a30b2b3d77b42a9cd50abf655e142", "tree": "df5d95036942bea48b9239e6c5028c8afc3f498c", "parents": [ "d7ac857e4dc69857f9ef21a32096950c09518aa6" ], "author": { "name": "Xiaobin Cui", "email": "xiaobincui@microsoft.com", "time": "Wed Aug 19 06:46:48 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 19 06:53:48 2026" }, "message": "Abort on Apple RNG failure instead of falling back to /dev/urandom\n\nOn macOS and iOS, getentropy() and CCRandomGenerateBytes() are\nguaranteed to succeed. The previous code treated failure as non-fatal\nand fell through to a /dev/urandom fallback—unnecessary on Apple\nplatforms and inconsistent with BoringSSL\u0027s approach of aborting\nimmediately on RNG failure.\n\nBug: 40641285\nChange-Id: I7f2477e1876cccf7354c877a8343222c77696dcc\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8002136\nCommit-Queue: Daniel Cheng \u003cdcheng@chromium.org\u003e\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nReviewed-by: David Benjamin \u003cdavidben@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1682068}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 315efe7d8b8208a89d4ef3f370ebdcb8c0e675e8\n" }, { "commit": "d7ac857e4dc69857f9ef21a32096950c09518aa6", "tree": "2365175d5eb950ef830b355b185d9a22c601ca23", "parents": [ "8a0694988ddbf7fdc5d10b65c505095b41d499e3" ], "author": { "name": "Keishi Hattori", "email": "keishi@google.com", "time": "Tue Aug 18 10:31:59 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Aug 18 10:36:20 2026" }, "message": "[MTE] Use random memory tagging unconditionally\n\nRandom memory tagging provides stronger security over deterministic tag\nincrementing by preventing predictable tag reuse.\n\nMake random memory tagging the only mode in PartitionAlloc and remove\nthe unused RetagMode feature param and PartitionOptions toggle.\n\nBug: 548247754\nChange-Id: I71756092f508a06ccaa6297b0bfbd0069420862a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8256793\nCommit-Queue: Keishi Hattori \u003ckeishi@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1681245}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 38a70bb651010c10b60c1ff42323c79214e35df9\n" }, { "commit": "8a0694988ddbf7fdc5d10b65c505095b41d499e3", "tree": "a4ef59432c5dff19c5425dd6db40ed530e1111fd", "parents": [ "0ee1bd8ebd8af732537e0c0ed851a6794ce0f961" ], "author": { "name": "ainozaki", "email": "ainozaki@google.com", "time": "Tue Aug 18 00:32:45 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Aug 18 00:43:21 2026" }, "message": "[PA] Clean up PartitionAllocFreeWithSize base::Feature flags\n\nThis CL cleans up the `PartitionAllocFreeWithSize` and\n`PartitionAllocStrictFreeSizeCheck` base::Feature flags.\n\nFixed: 410190984,495493036\n\nChange-Id: Ie89b4813d02a26e70404c7661c77ed91f097f306\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8200906\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Ai Nozaki \u003cainozaki@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1680943}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 4b0adad50c7fd23bd0f86ea85d9b6e730a38b7ff\n" }, { "commit": "0ee1bd8ebd8af732537e0c0ed851a6794ce0f961", "tree": "7275551d887201ddc79e4272009fc76e30c94748", "parents": [ "9a83f672059100d72f43e791c36c2839069bf1ff" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Mon Aug 17 09:35:12 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Aug 17 09:40:05 2026" }, "message": "Configure platform-specific defaults for PartitionAllocSchedulerLoopQuarantine.\n\nThis change splits the default configuration for\nkPartitionAllocSchedulerLoopQuarantineConfig based on the platform.\n\nLinux, macOS, and Windows retain the existing configuration targeting\nthe browser main thread.\n\nThe other platforms are still going through launch review, enabling them\nwas a mistake that slipped through.\n\nChange-Id: I09a3679f0c7cacc587013ae9eda663d21256888c\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8260887\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1680417}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: b6577cf10fcbb597908e441c1382beb76c6b20fa\n" }, { "commit": "9a83f672059100d72f43e791c36c2839069bf1ff", "tree": "9e256e401cfffd4d91112e51104377648c029937", "parents": [ "03cc513177b4340bee3dbfd46f6dd5fdded43b79" ], "author": { "name": "Nico Weber", "email": "thakis@chromium.org", "time": "Fri Aug 14 02:40:15 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 14 02:45:38 2026" }, "message": "base: Remove a few UNSAFE_TODO by converting to for-each loops\n\nPatch generated by running clang-tidy\u0027s modernize-loop-convert\non base/ and manually updating tweaked lines.\n\nNo intended behavior change.\n\nBug: 539052050\nChange-Id: I5d3f3d6a01373c59609a2ff0635764678f71e5fd\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8252389\nCommit-Queue: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nAuto-Submit: Nico Weber \u003cthakis@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1679299}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 62d529088f594f99d7e3e2d27b20b6b4c1c80d77\n" }, { "commit": "03cc513177b4340bee3dbfd46f6dd5fdded43b79", "tree": "fbbe7017a304ed0b535213d705ca212f9c9a2018", "parents": [ "7d6a15841642fa6b02874e3c461e332f17c7c33d" ], "author": { "name": "Gregg Tavares", "email": "gman@chromium.org", "time": "Wed Aug 12 02:35:13 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 12 02:42:29 2026" }, "message": "Fix ScopedSchedulerLoopQuarantineExclusion\n\nScopedSchedulerLoopQuarantineExclusion was\nexiting on the first invalid thread cache\ninstead of handling all of them.\n\nBug: 538701265\nChange-Id: I02faae787eb139af9b57679652e0cfc26a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8145820\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Gregg Tavares \u003cgman@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1677716}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 684217bd0672571af585e80822a44b860f06a65c\n" }, { "commit": "7d6a15841642fa6b02874e3c461e332f17c7c33d", "tree": "c55013bfdf9350a84b33205cfb4505b0663d4e1d", "parents": [ "f51f0758dbbcaaca9161bbe1f13ae0cf48130418" ], "author": { "name": "Gregg Tavares", "email": "gman@google.com", "time": "Mon Aug 10 09:46:55 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Aug 10 09:49:59 2026" }, "message": "Move ScopedSafetyChecksExclusion to PartitionAlloc\n\nIt was in base. Moving it to PartitionAlloc will make it more\neasily accessible to Skia so we can add exclusions for\nMiracleObject in hot spots in Skia.\n\nBug: 543719238\nChange-Id: Ied60ad8c9e289071867173ab9a70f0226a6a6964\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8221267\nCommit-Queue: Greg Thompson \u003cgrt@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nAuto-Submit: Gregg Tavares \u003cgman@chromium.org\u003e\nReviewed-by: Greg Thompson \u003cgrt@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1676321}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5f38af1c1170b0378bc56d7aff23007b3293c3c0\n" }, { "commit": "f51f0758dbbcaaca9161bbe1f13ae0cf48130418", "tree": "7ff38384a045d62c8151261da06540dea7966a5b", "parents": [ "601b19e8a41fba2b7d63b1af108ffa6e6bc565c6" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Fri Aug 07 09:34:16 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 07 09:37:01 2026" }, "message": "PartitionAlloc: Track wasted size from rounding for AlignedAlloc.\n\nCurrently when working with AlignedAlloc we will round up to the next\npower of two, this has sadly a bad consequence when the size itself is a\npower of two. Given that in most Partitions PartitionAlloc has to store\nthe inline metadata as well this will make the size be just ever so\nslightly larger than a power of two, and then we\u0027ll waste basically\ndouble the requested size.\n\nThis CL doesn\u0027t fix it (fix coming in follow up cl), but rather just\ntracks the opportunity cost so that we can compare how big of a chance\nthis is for memory savings.\n\nBug: 491627887\nChange-Id: Ia36785627b6fc9e4c51c92e31fa76b7ca271f3a9\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8152860\nReviewed-by: Joe Mason \u003cjoenotcharles@google.com\u003e\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1675596}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 8a291f3c407194c1171229007964afcbd61d1491\n" }, { "commit": "601b19e8a41fba2b7d63b1af108ffa6e6bc565c6", "tree": "0f30ec4b0eb4d692ad2791c7a26f48117c6e72dc", "parents": [ "b5214a8a59875915c19701b4aa004f9034be7830" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Fri Aug 07 04:42:04 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Aug 07 04:45:19 2026" }, "message": "PA: Remove `MaxDirectMapped()`\n\nThis is now simply `MaxAllocationSize()`.\n\nFixed: 542850291\nChange-Id: I372cd67d49ae7d8a3a6bc5874ac0f4c36c5762ea\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8221322\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nAuto-Submit: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1675499}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: d9b2b4c43b0c08a78d8cc1a7b7ea945ebf88f689\n" }, { "commit": "b5214a8a59875915c19701b4aa004f9034be7830", "tree": "ae3a32a13af5556a7ee7d797e2ea86a87a255d38", "parents": [ "4e780d3a98a6a80604e16574b1e5eba37efcf1f5" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Thu Aug 06 06:43:09 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Aug 06 06:46:14 2026" }, "message": "PA: Remove `Settings::in_slot_metadata_size`\n\nThis is now unused. (Refer to https://crrev.com/c/5331170) for a\nhistorical snapshot of its former usage.)\n\nChange-Id: I98b7addd10b01ba40826f6c54f3010a7889a343a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8211459\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nAuto-Submit: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCommit-Queue: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1674753}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f26cba06733c46e0f15ee560f3845370f027cf4a\n" }, { "commit": "4e780d3a98a6a80604e16574b1e5eba37efcf1f5", "tree": "d447cf0771343adbb540a54bbdc7e071b61cf7e4", "parents": [ "41619fc880dd2b9da16d9af345b64bb6ffe87540" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Thu Aug 06 05:43:37 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Aug 06 05:47:48 2026" }, "message": "PA: Add `MaxAllocationSize()`\n\nto be less domain-specific than `MaxDirectMapped()`. This is placed\ndirectly in the public `partition_alloc` namespace.\n\nCLs following this one will migrate external users to use the public\nspelling.\n\nThis CL was generated by Jetski and touched up by hand.\n\nBug: 542850291\nChange-Id: I737afb33780d7cacc418ffdd57a8772678f99510\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8200046\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1674733}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 8348f7385c58ae4985f8e0fa9b5a600419f5083f\n" }, { "commit": "41619fc880dd2b9da16d9af345b64bb6ffe87540", "tree": "1e7007ffcec8e0daa9bbeb10cefa9cac7b301830", "parents": [ "f13ab1ccec3822713e5f98f0aa056d7739e9213e" ], "author": { "name": "Chris Davis", "email": "chrdavis@microsoft.com", "time": "Wed Aug 05 20:19:02 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 05 20:22:41 2026" }, "message": "[PartitionAlloc] Adapt periodic reclaim interval to reclaimable memory\n\nThe memory reclaimer wakes on a fixed cadence regardless of how much\nthere is to reclaim, so a mostly idle process keeps paying for wake-ups\nthat free almost nothing. This adds an opt-in back-off: the interval\ndoubles toward a maximum while there is little decommittable memory and\nhalves back toward a minimum once there is a lot, mirroring the adaptive\nscheme ThreadCacheRegistry::RunPeriodicPurge() already uses.\n\nThe signal is the total memory held in empty slot spans, which is\nexactly what PurgeFlags::kDecommitEmptySlotSpans reclaims. Each root\nalready tracks that incrementally, so the new\nPartitionRoot::get_empty_slot_spans_dirty_bytes() reads it in O(1)\ninstead of walking every slot span via DumpStats().\n\nThe policy is gated behind the new\nkPartitionAllocAdaptiveMemoryReclaimInterval feature, disabled by\ndefault, with the bounds and the watermark exposed as field trial\nparams. While the feature is off, Reclaim() does no extra work and\nMemoryReclaimerSupport::GetInterval() behaves exactly as before; the\nexisting kPartitionAllocMemoryReclaimerInterval override still takes\nprecedence when set.\n\nMeasured on Windows x64 with an idle five-tab workload, counting reclaim\nwake-ups over a 300s steady-state window per process, three interleaved\nruns per threshold:\n\n threshold Browser GPU Storage Audio TOTAL vs fixed-4s\n fixed-4s 75.0 75.0 75.0 75.0 300.0 -\n 20KB 24.7 9.0 11.3 7.3 52.3 -83%\n 100KB 15.7 8.0 10.3 7.0 41.0 -86%\n 200KB 16.3 8.0 9.0 7.0 40.3 -87%\n\nWake-ups drop by 86% at the 100KB default. The cost is a larger decommit\nbatch per reclaim: the browser process averages 974KB per fire at 100KB\nversus 242KB on the fixed 4s cadence, so the watermark trades batch size\nfor wake-ups and is left as a field trial param for tuning. 200KB is not\ndistinguishable from 100KB in this data (means differ by 0.7 wakes\nagainst a standard deviation of ~3), so the less aggressive of the two\nis used as the default.\n\nAlmost all of the tuning sensitivity is in the browser process. The\nhelper processes stay below even the smallest watermark nearly all the\ntime and ramp straight to the 60s cap regardless of the threshold, while\nthe browser process spans 12.0s to 20.3s mean interval across the sweep.\n\nNote for configuring the field trial: leave the interval param of\nPartitionAllocMemoryReclaimer unset. GetInterval() consults it first and\nreturns early when it is positive, so a study that pins interval\ndisables this feature entirely while still appearing to be enabled.\n\nBug: 40273855\nChange-Id: I24fc18ba8de5b057be75166147871027d0f0421e\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8160268\nCommit-Queue: Chris Davis \u003cchrdavis@microsoft.com\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1674439}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 3036171dc0dcb8bd50badaf54c5a329755b9ca46\n" }, { "commit": "f13ab1ccec3822713e5f98f0aa056d7739e9213e", "tree": "1c795a8e12a80228bde3b9512462cf8f82dde63f", "parents": [ "3a5c0cf1898cbfb3e33bf44a0a98c18002b00c7d" ], "author": { "name": "Takashi Sakamoto", "email": "tasak@google.com", "time": "Wed Aug 05 08:11:41 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Aug 05 08:15:11 2026" }, "message": "PA: Check brp_enabled()-root or not before accessing metadata.\n\ncrrev.com/c/8135145 makes sanitized objects quarantined as miracle\nobjects, but the CL uses metadata without brp_enabled() check. If\nbrp_enabled() returns false, metadata are not available and it will\ncause crashes.\n\nBug: 541425545\nChange-Id: I2dc742de26a5c770d1827f8d7b4bbaf27be442be\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8199704\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1673960}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 930889460333b52c4ec7878f24123067a080e7fc\n" }, { "commit": "3a5c0cf1898cbfb3e33bf44a0a98c18002b00c7d", "tree": "0b2fdc98974895c80870b521dba6e8d5a43d16c9", "parents": [ "a3f1f24ec82192c02d2a112cc5fc5529b54407a0" ], "author": { "name": "David Bienvenu", "email": "davidbienvenu@chromium.org", "time": "Tue Aug 04 14:43:47 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Aug 04 14:46:39 2026" }, "message": "Fix partition alloc test failures\n\nRemove ThreadCache tombstone between tests so that global state changes\nin one test don\u0027t break other tests in the same process.\nAlternateTestParams/PartitionAllocTest.MultipleThreadCachePerThread/1 in\nparticular fails in first run and succeeds on retry.\n\nChange-Id: Ib771d976d9bfe6e226699d5340e5bb2fcf130043\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8184868\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: David Bienvenu \u003cdavidbienvenu@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1673331}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: df3f856e8b2365697d0ef06ee1df45eeed689df5\n" }, { "commit": "a3f1f24ec82192c02d2a112cc5fc5529b54407a0", "tree": "45360f6686e99d6e7877a4470f0443aa66cf5adb", "parents": [ "34ad87ad7db364e5a76da6027002f88fce249dc9" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Tue Aug 04 04:09:00 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Aug 04 04:13:55 2026" }, "message": "PA: Update requested sizes on realloc\n\nIf we are to rely on the requested size for anything, these need to be\nkept up-to-date.\n\nFixed: 540914685\nChange-Id: I43e7e82b08ec0ee54d7affb796860c78c2d88488\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8184339\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1673086}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: b2ad59662f521c6e2781ee7967b79fd775b88e90\n" }, { "commit": "34ad87ad7db364e5a76da6027002f88fce249dc9", "tree": "68fa7746327883e2c3ab96c51656f5954d83df8b", "parents": [ "29013c81d1fa46475bdf6608d71a10b5ebab3f48" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Tue Aug 04 04:02:18 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Aug 04 04:06:52 2026" }, "message": "PA: No-op rework for normal-bucket realloc\n\nWhen attempting to realloc inline in a normal bucket, we may want to\ntouch the `InSlotMetadata` even when the slot can\u0027t store the raw size.\nThis CL simply moves the variable outside the `if` gate so that this\nwill be possible in a future CL.\n\nThe compound condition (\"has BRP build support AND is DCHECK\") gets to\nbe a mouthful; some locally used `#define`s are introduced to make it\nless wordy.\n\nOne small behavioral change is made, manifesting the `InSlotMetadata` of\na normal-bucket slot unconditionally (no longer just when the slot can\nstore the raw size). This shouldn\u0027t be a huge problem, because it\nhappens either when\n\n1. the build has `DCHECK()`s enabled (not performance-sensitive) or\n2. the build will (in the future) manipulate the requested size stored\n in the `InSlotMetadata` unconditionally.\n\nBug: 540914685\nChange-Id: I7a8ebd31b5aaee9487984f8b5596804c9c59a054\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8184338\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1673081}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f3347af8d04eb0a5d50a4df0dbaed5b5d71127c4\n" }, { "commit": "29013c81d1fa46475bdf6608d71a10b5ebab3f48", "tree": "d3cce3aa1f5725c120d59e039e7ae5a83186a670", "parents": [ "ad56996fecb8731dec9d9137430b91b0906e8137" ], "author": { "name": "Keishi Hattori", "email": "keishi@google.com", "time": "Fri Jul 31 07:21:15 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Jul 31 07:24:45 2026" }, "message": "[PartitionAlloc] Fix MTE retagging bypass in Scheduler-Loop Quarantine\n\nInitialize slot_size with BucketIndexLookup::GetBucketSize() prior to\ncalling RetagSlotIfNeeded() in PurgeInternal(). Previously, slot_size\nwas initialized to 0 at the top of the loop as a placeholder for later\naccounting, causing RetagSlotIfNeeded(ptr, 0) to abort early as a no-op\nwithout executing ARM Memory Tagging Extension (MTE) hardware retagging\ninstructions.\n\nConsequently, slots leaving Scheduler-Loop Quarantine returned to the\nfreelist or thread cache with their original pre-free MTE tags intact. A\ndangling pointer from before the free could access reallocated memory\nwithout triggering an MTE fault.\n\nBy calculating the true bucket size before invoking RetagSlotIfNeeded(),\npurged slots always receive a new MTE tag before being reused.\n\nAdd MTEProtectsFreedPtrViaSchedulerLoopQuarantine regression unit test\nunder HAS_MEMORY_TAGGING to verify tag inequality across reallocation.\n\nTAG\u003dagy CONV\u003d4a78b948-43d2-464e-9799-38644f4a90bf\n\nBug: 493201557\nChange-Id: I4438bf9d92487552f3a3eb0fa312e5e694f7c51f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8166380\nCommit-Queue: Keishi Hattori \u003ckeishi@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1671668}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f930ab45c50d18845c5133c58926dec04a205d82\n" }, { "commit": "ad56996fecb8731dec9d9137430b91b0906e8137", "tree": "58c40e7ed3a6b794e202f30e4d4d7930232280fa", "parents": [ "d7aeed15f395f59cf998dce0682e2b3a9ce938d3" ], "author": { "name": "Keishi Hattori", "email": "keishi@google.com", "time": "Thu Jul 30 18:49:59 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jul 30 18:53:09 2026" }, "message": "[PartitionAlloc] Order SetQuarantineRequest() before ReleaseFromAllocator()\n\nOrder SetQuarantineRequest() before calling ReleaseFromAllocator() in\nFreeNoHooksImmediateInternal(). Once ReleaseFromAllocator() is called,\nit clears kMemoryHeldByAllocatorBit on the InSlotMetadata ref count. If\na concurrent thread destroys the last raw_ptr pointing to the object at\nthat exact moment, it will invoke FreeAfterBRPQuarantine().\n\nWhen FreeAfterBRPQuarantine() is called on another thread before the\nquarantine bit is set, two critical problems occur:\n\n1. PopQuarantineRequest() returns false, which skips routing the\n slot to SchedulerLoopQuarantine().\n2. The slot is freed immediately via RawFreeWithThreadCache(), which\n calls RetagSlotIfNeeded() and updates the ARM Memory Tagging\n Extension (MTE) tag of the slot in RAM. When the freeing thread then\n attempts to execute SetQuarantineRequest(), accessing the pointer\n causes an MTE synchronous tag check fault (SEGV_MTESERR).\n\nSetting SetQuarantineRequest() prior to ReleaseFromAllocator() ensures\nthat FreeAfterBRPQuarantine() correctly identifies scheduler loop\nquarantine requests without race conditions or tag faults.\n\nTAG\u003dagy CONV\u003d4a78b948-43d2-464e-9799-38644f4a90bf\n\nChange-Id: Ic7a3abb55f5c049bad8e8149d888ec74e798b5c1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8161565\nCommit-Queue: Keishi Hattori \u003ckeishi@chromium.org\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1671288}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 53d532295ca94f0c77d542f65ffb2426290c6a4f\n" }, { "commit": "d7aeed15f395f59cf998dce0682e2b3a9ce938d3", "tree": "28e0827f6abfe2afb8d3b37139075d4e8806e9bc", "parents": [ "a134c160c51685329230b6323e4c8e3052cbf13d" ], "author": { "name": "Keishi Hattori", "email": "keishi@google.com", "time": "Thu Jul 30 06:54:55 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jul 30 06:59:03 2026" }, "message": "MiraclePtr: Add ReportIfDangling stub to RawPtrNoOpImpl\n\nWhen raw_ptr\u003cT, UnprotectedInRelease\u003e falls back to RawPtrNoOpImpl in\nnon-BRP release builds, binding the pointer via base::Unretained in\ncontexts where MayNotDangle is checked calls ptr.ReportIfDangling().\nRawPtrBackupRefImpl implements static void ReportIfDangling(T*), but\nRawPtrNoOpImpl lacked a corresponding no-op stub method, causing\ncompiler errors during callback binding.\n\nThis change adds an empty static ReportIfDangling stub to RawPtrNoOpImpl\nto ensure build compatibility across all pointer trait combinations.\n\nTAG\u003dagy\n\nBug: None\nChange-Id: Ib0fb153cf6b387b6456785792b85eea1830e4b77\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8172284\nCommit-Queue: Keishi Hattori \u003ckeishi@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1670869}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a92bc0620a782fc830ad01301a4b3046518bd9d7\n" }, { "commit": "a134c160c51685329230b6323e4c8e3052cbf13d", "tree": "2ac376f4157a87e1f0e55cd626d98feb1b3a5968", "parents": [ "f5fbe01c81eb627bb3ab48c0d3d70df6722e0014" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Thu Jul 30 06:08:06 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jul 30 06:11:50 2026" }, "message": "Busybody: Don\u0027t depend on outside variables\n\nThis CL should be a no-op. PartitionAlloc tries to avoid outside (esp.\nChromium-specific) build dependencies in GN recipes. This CL adds the\nusual indirection to a few stragglers defined outside PartitionAlloc\u0027s\nsource directory.\n\nThis CL was mostly generated with Jetski and reined in by hand, to\nrestrict the change only to the most obvious cases. N.B. Jetski\u0027s\nanalysis appears wrong in places.\n\nChange-Id: I982901212846c27d8688ad8d20ea321bde6d0e92\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8161843\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nAuto-Submit: Kalvin Lee \u003ckdlee@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1670847}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ed6af269c0e97f65fcff3d81775511cd96a56b2e\n" }, { "commit": "f5fbe01c81eb627bb3ab48c0d3d70df6722e0014", "tree": "59a768c57f62e87417cfd66d47bcdb6d9d1bead5", "parents": [ "6abc77b2ec9f16df21a84f47c0bce6e7ab984036" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Wed Jul 29 18:00:32 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jul 29 18:06:23 2026" }, "message": "partition_alloc: Expose less internal bits\n\nIn partition_alloc_constants.h, stop exposing internal bits that are not\nactually used externally. For usage within partition_alloc itself, use\nthe internal namespace.\n\nChange-Id: Idc918b070ff23ce183abb1dfbfd7957ae51c446a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8165745\nReviewed-by: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1670413}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 57b94443f3e50bbb329cad8902c60770efbef0bc\n" }, { "commit": "6abc77b2ec9f16df21a84f47c0bce6e7ab984036", "tree": "0481b18edb53e775572038fcc655b0f357dca6f9", "parents": [ "a7fbe3ea781cd19875dc35e12ba99b52838d974f" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Tue Jul 28 23:37:55 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jul 28 23:41:19 2026" }, "message": "partition_alloc: Cleanup pre-C++20 code in compiler_specific.h\n\nNow that C++20 is widely available, just use __has_cpp_attribute(),\nconstinit and constexpr directly. Delete conditional defines that\nassumed these C++20 language features may not be available.\n\nNO_IFTTT\u003dNo behavior change.\n\nChange-Id: I39224abfc81ed726d606fe2e7dbe964fa4fdd012\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8162521\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1669861}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 953562c4e8dc407eab1fa0c374bc14e98ffda4c0\n" }, { "commit": "a7fbe3ea781cd19875dc35e12ba99b52838d974f", "tree": "31e0a860a282cb2cfdb353a85abb3825a4a115fa", "parents": [ "43b48ec3cef9bf69564014648634d924bd65bc01" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Tue Jul 28 23:32:07 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jul 28 23:34:53 2026" }, "message": "partition_alloc: Switch kSameAsAny to a C++20 concept\n\nNow that C++20 is widely available, fulfill a TODO and sync PA\u0027s\nsame_as_any.h with the other copy in //base.\n\nBug: 344963951\nChange-Id: I3d2c935607bc80789389e6a154103024d1e84b87\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8162523\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1669858}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 5d1b242829fc74ca5e9620f978c2185df437574b\n" }, { "commit": "43b48ec3cef9bf69564014648634d924bd65bc01", "tree": "b980cac7ed551b5b383cb662ce409ec8af2b393b", "parents": [ "6fb47fe744962fed36cfeab597d38123d6065b8d" ], "author": { "name": "Takashi Sakamoto", "email": "tasak@google.com", "time": "Tue Jul 28 06:51:32 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jul 28 06:55:06 2026" }, "message": "PA: quarantine sanitized objects as miracle objects after dequarantined\n\nThis is a short-term fix to make sanitized objects (i.e. objects with\nAMSC macro) not to skip miracle objects\u0027 protection.\n\nThis CL makes SchedulerLoopQuarantineBranch for sanitized objects use\nFreeNoHooksImmediateInternal() with FreeFlags::kSchedulerLoopQuarantine\ninstead of RawFreeLocked() and to give SchedulerLoopQuarantineBranch for\nmiracle objects a chance to quarantine the objects. This requires\n`usable_size` memory zapping (not `slot_size`). Because if\n`slot_size`-region is filled with kFreeByte, `InSlotMetadata` and\nPartition Cookie will be broken. It will cause\nInSlotMetadata::CheckCookieIfSupported() failure or\nPartitionCookieCheckValue() failure.\n\nBug: 501113274\nChange-Id: I7d39c389fef69dcef3bc43a8e4d9f1346ca486a1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8135145\nAuto-Submit: Takashi Sakamoto \u003ctasak@google.com\u003e\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1669248}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: a8b58bf7017325d5d2dfe5a8c9d4813306298458\n" }, { "commit": "6fb47fe744962fed36cfeab597d38123d6065b8d", "tree": "82b732ea81fa30a77a88f377396d54e1a5e64503", "parents": [ "0f047f38aca8c1d8fcdb3dc2ff3899e5cd639d4a" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Tue Jul 28 04:43:16 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jul 28 04:46:03 2026" }, "message": "partition_alloc: Simplify RotR()\n\nRemove the PA_NOTREACHED() usage.\n\nChange-Id: I476edb8e9cc89347bae353ee74bc4581f070a093\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8145465\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1669201}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: c4b9cee4a2bd176b039f47a63f461bf738e46264\n" }, { "commit": "0f047f38aca8c1d8fcdb3dc2ff3899e5cd639d4a", "tree": "d791262e284a1e7d8526e841cbfac50b66af7249", "parents": [ "7eeface2375da12c01f93242635f100942739403" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Tue Jul 28 00:18:24 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jul 28 00:21:28 2026" }, "message": "partition_alloc: Remove PA_HAVE_SPACESHIP_OPERATOR\n\nNow that C++20 is widely available, stop assuming the build may be\nmissing spaceship operator support.\n\nChange-Id: Id4fb7e33ac6ebc270a71c76505ec30b3803094eb\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8157623\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1669103}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 8c8aa482a9ef1dbd63e1490748708c09c163a0f9\n" }, { "commit": "7eeface2375da12c01f93242635f100942739403", "tree": "709dee6422610219c926d7b1d8d37a8c32f869f8", "parents": [ "64a11a4440a2b930c95e8bece059c54a861b79dc" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Mon Jul 27 22:31:24 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jul 27 22:34:36 2026" }, "message": "partition_alloc: Replace CountlZero() with std::countl_zero()\n\nNow that C++20 is widely available, switch to std::countl_zero().\n\nNO_IFTTT\u003dNo behavior change.\n\nChange-Id: Iab954ef3395fa95760af01b0e06c7111efce9718\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8145464\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1669036}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 4abd497b7185e1caa4116e70edb5037de4c79edb\n" }, { "commit": "64a11a4440a2b930c95e8bece059c54a861b79dc", "tree": "e2c6e8b1be8489a12b18f623e1ae7b6a998cf7f0", "parents": [ "09f2979b22bf8beaabb4a3fd15f4d1df1d0ff42a" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Mon Jul 27 20:00:36 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jul 27 20:05:59 2026" }, "message": "partition_alloc: Replace CountrZero() with std::countr_zero()\n\nNow that C++20 is widely available, switch to std::countr_zero().\n\nChange-Id: I2271933c8eea237da9c0e30e4a49a592602a3842\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8145463\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1668909}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e9a046eeafe7cb4cdb33ee88805c2b96ad946083\n" }, { "commit": "09f2979b22bf8beaabb4a3fd15f4d1df1d0ff42a", "tree": "ece30efc9044160f3491dd4c69eb167140b1723d", "parents": [ "d0d87ed6b9047672b4e156952f82f874c5660016" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Mon Jul 27 19:59:39 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jul 27 20:03:06 2026" }, "message": "partition_alloc: Replace BitWidth() with std::bit_width()\n\nNow that C++20 is widely available, switch to std::bit_width().\n\nChange-Id: If2f2d2bb844e38f11871e58119ebbbb064b60175\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8145462\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1668908}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 1122e917453dbe19640871f4b86f7f9ee843ec96\n" }, { "commit": "d0d87ed6b9047672b4e156952f82f874c5660016", "tree": "4ebc600c8841695de4731a65eab5b92e65289774", "parents": [ "66df8ef636795eff70efc52a47d8f62612800054" ], "author": { "name": "Lei Zhang", "email": "thestig@chromium.org", "time": "Mon Jul 27 19:59:23 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jul 27 20:02:28 2026" }, "message": "partition_alloc: Replace HasSingleBit() with std::has_single_bit()\n\nNow that C++20 is widely available, switch to std::has_single_bit().\n\nChange-Id: I3afd1c18f690b4dc0eeb0232fdcde622c35be933\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8145461\nCommit-Queue: Lei Zhang \u003cthestig@chromium.org\u003e\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1668907}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7cd8bbec4271d2fec6794acea4e6cc4712f7f3fb\n" }, { "commit": "66df8ef636795eff70efc52a47d8f62612800054", "tree": "0c61d976e8f1e8e306176e3e714fdf4508ad211d", "parents": [ "bbd8b39daef60f2290a469378114ca546e2729f9" ], "author": { "name": "Tom Sepez", "email": "tsepez@google.com", "time": "Thu Jul 23 19:53:09 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jul 23 19:56:08 2026" }, "message": "Remove unused kUnprotectedInRelease constant.\n\nPrevious CLs have moved callers onto the non-k-prefixed form.\n\n-- One line change for easy revert if required.\n\nChange-Id: Ie42440c68bf81c3ac9d423dc87e6fa8bcda3a025\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8119571\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCommit-Queue: Tom Sepez \u003ctsepez@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1667338}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: ace71214edd7c575e4d1a1d5fabaf9d8abc666a5\n" }, { "commit": "bbd8b39daef60f2290a469378114ca546e2729f9", "tree": "04b500659cdbf4be80389cb1c62197bfa023d3a6", "parents": [ "247cfd34b260469d17839c76636308ed414611f2" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Thu Jul 23 08:46:55 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jul 23 08:50:32 2026" }, "message": "Introduce `CHECKED_SPAN_HAS_METADATA_SUPPORT`\n\nThis PartitionAlloc buildflag supports additional Checked Span zapping.\nThe current design is contingent on `InSlotMetadata`, i.e. BRP build\nsupport.\n\nAs an aside, this CL introduces a basic check contingent on reading\n`InSlotMetadata`: it asserts that constructing a `base::span` pointing\nto memory that PartitionAlloc thinks is not alive is generally wrong.\n\nThis CL does not introduce behavioral change, as the buildflag is\ndefault-disabled.\n\nBug: 534387022\nChange-Id: Ie67239333e6172d026588ff5ef1f8bb2aeda3edc\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8106435\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1666911}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 75953b8ae12fcba81615b458c3d8447ad73bc552\n" }, { "commit": "247cfd34b260469d17839c76636308ed414611f2", "tree": "82adfb76c515e476094f7fad1202aae2b1a9ae46", "parents": [ "f2439d98480eab8d5bb73f8c0555575c0a086f5f" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Thu Jul 23 03:25:40 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jul 23 03:28:32 2026" }, "message": "Improve ASLR hints in PartitionAlloc on Android.\n\nCurrently the zygote copies the random seed initial state. This can\ncause new processes to share the same seed making the randomization\npredictable between process starts.\n\nWe fix this by reseeding between forks.\n\nBug: 513507022\nChange-Id: I929c85205d2020e93a283130239b2af341933863\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8129930\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1666819}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 57275f0fb393be70f06b1d528ba56da4c1b13d01\n" }, { "commit": "f2439d98480eab8d5bb73f8c0555575c0a086f5f", "tree": "4d7b3bdf859005ac531c6f15b52a2b700dbd0298", "parents": [ "8454eacd11f112e53b702b6a0a6bb9a25d4896c2" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Wed Jul 22 16:28:23 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jul 22 16:32:19 2026" }, "message": "Checked Span: Don\u0027t check zero-sized spans\n\nThis fix is speculative. The concrete justification is that this CL\nappears to prevent a crash in `media_pipeline_integration_fuzzer` ---\na consistent repro disappears in my checkout when this CL is applied.\n\nIn principle, `span::data()` is an uninteresting heuristic for\ndetermining whether or not we should bounds-check a span. `size()` alone\nsuffices, and relying on `data()` at all was a mistake from the outset.\n\nThe speculative justification for this CL is written out in full on the\nissue tracker; in short, a caller could attempt to construct a Checked\nSpan from an end-of-allocation pointer, indistinguishable from the start\nof the next slot. If no such slot actually exists, PartitionAlloc could\ncrash.\n\nFixed: 535964021\nValidate-Test-Flakiness: skip\nChange-Id: I7213ce840f85d209077b335ea1f727031feb0583\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8130658\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1666392}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 6bfc8974d0650de6a12e942d18b61e536c4e1c30\n" }, { "commit": "8454eacd11f112e53b702b6a0a6bb9a25d4896c2", "tree": "7edd8c931130a894df1cf32cbe0fc8464f51b528", "parents": [ "02115967c809ba516e0a87e09afc99c05af042ad" ], "author": { "name": "Tom Sepez", "email": "tsepez@google.com", "time": "Wed Jul 22 03:33:29 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jul 22 03:37:06 2026" }, "message": "Drop k from public constant kUnprotectedInRelease.\n\nNone of the other public constants have the k-prefix, although raw_ptr\nuses k-prefix constants internally.\n\nProvides duplicate constant so that a one-line follow-on change can\nremove the deprecated form (for easy revert if needed).\n\nChange-Id: I66aaaf7be473f66524805339a27374535e4f6832\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8109259\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nOwners-Override: Daniel Cheng \u003cdcheng@chromium.org\u003e\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCommit-Queue: Tom Sepez \u003ctsepez@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1665998}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 443f14f00b6d93fc0125914744a477699467dd68\n" }, { "commit": "02115967c809ba516e0a87e09afc99c05af042ad", "tree": "b546f0c434067bb1510f20b137f189d63c28cbf1", "parents": [ "13a31553157fde520808c478474abbf393318391" ], "author": { "name": "Jiewei Qian", "email": "qjw@chromium.org", "time": "Tue Jul 21 06:03:11 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jul 21 06:06:23 2026" }, "message": "apple_apsl: mark malloc.h as Static\n\nPer discussions in https://crbug.com/502791044, this dependency is the calling contract between Chromium and macOS, and therefore qualifies under Static category.\n\nBug: 502791044, 537106252\nChange-Id: I3b45d0f2f8e016a7352a22c4db6dcd5ec098eb19\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8128696\nCommit-Queue: Jiewei Qian \u003cqjw@chromium.org\u003e\nReviewed-by: Kentaro Hara \u003charaken@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1665200}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: bc0e706293d048b378dd4a71e53dc0021fef1ac4\n" }, { "commit": "13a31553157fde520808c478474abbf393318391", "tree": "92d4ab996a4db5baadb99c48253526ad3ddd5735", "parents": [ "522f5c1c8507bbbcdee769a948f38994e3e8cd21" ], "author": { "name": "Tom Sepez", "email": "tsepez@google.com", "time": "Fri Jul 17 16:38:58 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Jul 17 16:43:32 2026" }, "message": "Introduce RawPtrIfPtrT type trait for conditional raw_ptr conversion\n\nAdds `RawPtrIfPtrT\u003cT\u003e`, which converts pointer types (`T*` and\n`raw_ptr\u003cT\u003e`) to `raw_ptr\u003cRemovePointerT\u003cT\u003e\u003e` while leaving non-ptr\ntypes unchanged. This is useful for APIs where pointer types may be\nconditionally defined as pointers or smuggled as scalars.\n\nChange-Id: If9a8d537d6be928d344e71696f424bc79d04a571\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8102182\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Tom Sepez \u003ctsepez@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1663979}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 2f8d49b3d474019d8e6a73b9941af82742087c04\n" }, { "commit": "522f5c1c8507bbbcdee769a948f38994e3e8cd21", "tree": "3c9f5465251977389fee03b29a726ca4c4ee066e", "parents": [ "5d73585648db988687b6934f04dc03c22d4c0798" ], "author": { "name": "Takashi Sakamoto", "email": "tasak@google.com", "time": "Fri Jul 17 09:16:03 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Jul 17 09:20:54 2026" }, "message": "PA, EULD: EULD samples objects which SchedulerLoopQuarantine will not handle\n\nEULD checks whether the given objects will be quarantined by\nScheulderLoopQuarantine or not. If SchedulerLoopQuarantine will\nquarantine them, EULD will not sample them.\n\nChange-Id: I42f8e4274728b9acba0c77d6ebb3de8e862cd5f4\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8070250\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Sergei Glazunov \u003cglazunov@google.com\u003e\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1663753}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e8f0bf97c5d8b2fdfe20938719689ca74c127373\n" }, { "commit": "5d73585648db988687b6934f04dc03c22d4c0798", "tree": "7594555bb03b63fb89b8800b98d52e6b2e86a95d", "parents": [ "b4e94c050a87730a6ddadf915e40ec6d23353cde" ], "author": { "name": "Arthur Sonzogni", "email": "arthursonzogni@chromium.org", "time": "Thu Jul 16 19:12:30 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jul 16 19:17:20 2026" }, "message": "partition_alloc: Define is_lsan and is_msan for standalone build\n\nDefine is_lsan and is_msan to false by default in the standalone\nBUILDCONFIG.gn. This fixes the standalone build which was broken\nafter MEMORY_TOOL_REPLACES_ALLOCATOR was migrated to a buildflag\nthat uses these variables.\n\nReference bug: https://github.com/ArthurSonzogni/PartitionAllocTest/issues/2\n\nBug: None\nChange-Id: I7f12d02e50b2e9c9ef5cf9cab0837e4659433296\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8108339\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1663385}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7ce4449f6826afba3ff787b621a0daeab68c9e3f\n" }, { "commit": "b4e94c050a87730a6ddadf915e40ec6d23353cde", "tree": "0cf0fde47df9579a0f61731d4e7f6141cb85890a", "parents": [ "128709de4c1d46c6f0f79207a4e54a2ceb4bfc44" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Wed Jul 15 13:51:50 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jul 15 13:54:20 2026" }, "message": "Enable BackupRefPtr feature flag on CastOS.\n\nThis change removes the explicit exclusion of CastOS from the\n`enable_backup_ref_ptr_feature_flag` condition, allowing BackupRefPtr to\nbe enabled on CastOS.\n\nSee internal email thread:\nhttps://groups.google.com/a/google.com/g/chrome-memory-safety/c/hd-IhSKGEQM\n\nAlso see public bug: crbug.com/41489655\n\nis_castos is mostly now deprecated and as such we can move the last\nunsupported platform for BRP to enabled.\n\nBug: 41489655\nDanglingUntriaged-notes: Enabling BRP on CastOS, pre-existing.\nChange-Id: I949cec6fee20d2270a1fc751fbca00ba6d1b8f0b\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8014988\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Jordan Bayles \u003cjophba@chromium.org\u003e\nCommit-Queue: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Shawn Quereshi \u003cshawnq@google.com\u003e\nReviewed-by: Adam Rice \u003cricea@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1662548}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 11311b11f5d060e6cc5aca142d0a990a771140e3\n" }, { "commit": "128709de4c1d46c6f0f79207a4e54a2ceb4bfc44", "tree": "1ff2e120e50c693749f5dacb0635329ea7480df1", "parents": [ "0a0c55be3ce3cdcd92ab6e790adee41031ae5530" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Wed Jul 15 07:15:00 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jul 15 07:19:49 2026" }, "message": "Reduce calls to metadata offset and ReservationTable::Get\n\nPreviously metadata_offset was called 3 times, and\nReservationOffsetTable::Get was called 2, and each call requires\ncomputing the mask again. As well as the offset_tag for seeing if it is\na direct map and reservation.\n\nWe reduce this with a new wrapper type and a new Query function in\nPartitionAddressSpace. The type computes all the address information at\nonce (offset tag, type, direct map start if directmap) and returns that.\nWe can then pass that along ensuring we don\u0027t add extract calls into\nPartitionAlloc.\n\nChange-Id: I5a89d3054e222991e73763807b07b95b4d4ab3c1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7844235\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nReviewed-by: Kalvin Lee \u003ckdlee@chromium.org\u003e\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1662409}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 25eefa60dc79716b83cb208682f9b4f41a4d50de\n" }, { "commit": "0a0c55be3ce3cdcd92ab6e790adee41031ae5530", "tree": "779b8227cc563e45717d6107f5912085974dedce", "parents": [ "4b811f950d583d96f7bc7a605a9b28ddf790ae77" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Tue Jul 14 23:11:46 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jul 14 23:18:06 2026" }, "message": "Remove unnecessary PA_UNSAFE_TODO in partition Alloc\n\nAfter Library arrayification (conversion from c-like arrays to\nstd::array for safety) many UNSAFE_TODOs are no longer required while\nhardened.\n\nThis CL is the result of running a modifiyed version of the\nunsafe_todos_remover.py to execute only in the partition_alloc library\nsubstituting around 30 occurrences.\n\nBug: 501143531\nChange-Id: I69294dfc6754e97c67cc8a698f7f30a00dc9b680\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8057887\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1662240}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 084d159df92d23ec3123cc89409fb4c4fb8859c5\n" }, { "commit": "4b811f950d583d96f7bc7a605a9b28ddf790ae77", "tree": "a92dd67b497f2e8ca7c4d7cb31b50f2625012456", "parents": [ "1a5a7f590d6852a873a43b832046b89f868bb496" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Tue Jul 14 07:34:41 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jul 14 07:37:25 2026" }, "message": "Checked Span: Crash on nullptr bucket\n\nAlthough the root cause remains unknown, this CL converts the nullptr\nbucket handling to crash instead of silently returning \"not out of\nbounds.\"\n\nSee https://crrev.com/c/7953898 for context.\n\nBug: 484171909\nChange-Id: I27b60891f1a0232d721ea79d74f42b6c34f91dad\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8061329\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1661664}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 6f9650e349b3a95bc936c0eb0452c34c47b9d304\n" }, { "commit": "1a5a7f590d6852a873a43b832046b89f868bb496", "tree": "e18c74812c748e4768e2036ce105db34d64602db", "parents": [ "407e9f8b2be6bf2e738c2a87806e10ca4e17e909" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Mon Jul 13 05:45:55 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jul 13 05:47:55 2026" }, "message": "PA: Remove `AllocInline()`\n\nThere should be no more users. Make `Alloc()` properly `PA_NOINLINE`\n(n.b. just propagating the annotation already present on\n`AllocInline()`).\n\nFixed: 531793723\nChange-Id: I0e11c18ef2ca04452c6a5c6f2a3e89b24f885f66\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8051729\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1660951}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: cd9e004aa2087d4a088d8542855d756fe57dd0ab\n" }, { "commit": "407e9f8b2be6bf2e738c2a87806e10ca4e17e909", "tree": "8dc2c7098cf0ba2aaf0461cc085c23bd15a431d2", "parents": [ "f36d5a2c8460f1c82885165601a942717a39c0f0" ], "author": { "name": "Arthur Sonzogni", "email": "arthursonzogni@chromium.org", "time": "Fri Jul 10 17:00:06 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Jul 10 17:01:55 2026" }, "message": "partition_alloc: Migrate MEMORY_TOOL_REPLACES_ALLOCATOR to PA buildflag\n\nMove MEMORY_TOOL_REPLACES_ALLOCATOR from a global //build define to a\nlocal partition_alloc buildflag.\n\nThis enables PartitionAlloc to compile standalone when embedded in other\nprojects without depending on //build. Using a buildflag also prevents\nsilent errors if the defining config is missing.\n\nWe double-checked that MEMORY_TOOL_REPLACES_ALLOCATOR is not used in\nbuild embedders: v8, Dawn, ANGLE, PDFium, WebRTC, and SwiftShader.\n\nAdditionally, the legacy macro has been banned in PartitionAlloc by\nremoving it from the PRESUBMIT.py allowed list.\n\nBug: 351867706\nChange-Id: I2fc46a66ab4ff4ccfae36a057e7977a3e3b21f48\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7871106\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nReviewed-by: Hans Wennborg \u003chans@chromium.org\u003e\nReviewed-by: Titouan Rigoudy \u003ctitouan@chromium.org\u003e\nAuto-Submit: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1660347}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 1c41747a9ae220994d4a97bcd9b29d6a85d0949f\n" }, { "commit": "f36d5a2c8460f1c82885165601a942717a39c0f0", "tree": "c0c81117ad2c13dd7e6f879db66b3332712b88da", "parents": [ "4de29aa30a684141e803e786d1f511ed362b1165" ], "author": { "name": "Kalvin Lee", "email": "kdlee@chromium.org", "time": "Thu Jul 09 05:50:07 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jul 09 05:51:43 2026" }, "message": "Checked Span: Annotate likeliness\n\nThis CL is conservative.\n\n1. Conditioned on memory being owned by PartitionAlloc, it\u0027s likely\n owned by direct map or a normal bucket.\n2. It is expected that most extents not to be out of bounds.\n\nNo position is taken on whether or not most callers of\n`IsExtentOutOfBounds()` (i.e. probably most users of Checked Span) call\nwith memory owned by PartitionAlloc.\n\nBug: 484171909\nChange-Id: Ibd8a14d1ab3ba787ba0c039e7744671981177be5\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8061328\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1659326}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 821f9c50add7c3ebf53c734e79a99140c0018947\n" }, { "commit": "4de29aa30a684141e803e786d1f511ed362b1165", "tree": "47402be219f22bb10c46137851acb9622d3f63ff", "parents": [ "20dce94c44effd193252ef25eae05efe4518c338" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Tue Jul 07 17:46:02 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jul 07 17:47:57 2026" }, "message": "Automatic Arrayification for partition alloc\n\nThis is the result of arrayification in the partition alloc library, the first step towards spanification.\n\nChange-Id: I94d65a917bbd9a4133e822131a6c94eebac5c06e\nBug: 501143531\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8037246\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1658083}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 43305f687a7ace0ce9c49bd6d406012d10324573\n" }, { "commit": "20dce94c44effd193252ef25eae05efe4518c338", "tree": "ff89b414e0ee6693c1f28482181eebaaf63351c4", "parents": [ "75037eb5a18977a738a53f7d4f28dce370d6034a" ], "author": { "name": "Egor Pasko", "email": "pasko@chromium.org", "time": "Mon Jul 06 23:20:11 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jul 06 23:21:46 2026" }, "message": "PartitionAlloc: Restore StackTopRegistry::GetCurrentThreadStackTop\n\nThe StackTopRegistry::GetCurrentThreadStackTop() is soon going to be\nused for MiracleObject, requiring stack scanning. Revert it to the\noriginal form (as before crrev.com/1657146). Previously I replaced the\nbody of this method with PA_NOTREACHED because I mistakenly assumed no\nusage is approaching.\n\nBug: 518605818, 530922114\nChange-Id: Idb485293117a055d09f19635fbe9bdf8dba05d7f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8044903\nReviewed-by: Mikihito Matsuura \u003cmikt@google.com\u003e\nAuto-Submit: Egor Pasko \u003cpasko@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1657562}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: d00706dc3f886d6929adaa45c3bbbcc748c99a41\n" }, { "commit": "75037eb5a18977a738a53f7d4f28dce370d6034a", "tree": "9ff401d320683f43438049a33257942c7a818b37", "parents": [ "16ccc3966b226601d583688dce48a22fc404af88" ], "author": { "name": "Helmut Januschka", "email": "helmut@januschka.com", "time": "Mon Jul 06 14:32:18 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jul 06 14:33:54 2026" }, "message": "Rename Time::kTimeTToMicrosecondsOffset to kMicrosecondsFromWindowsToUnixEpoch\n\nBug: 355423207\nChange-Id: I5d9edbbc461d8c0ee9cb991e4239d9a1674e343f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8040566\nReviewed-by: Gabriel Charette \u003cgab@chromium.org\u003e\nCommit-Queue: Gabriel Charette \u003cgab@chromium.org\u003e\nOwners-Override: Gabriel Charette \u003cgab@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1657178}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: af8aa1ae8a505f9695c95153fb08b8058ca5f14d\n" }, { "commit": "16ccc3966b226601d583688dce48a22fc404af88", "tree": "8ba0ca2bb257101caf10a1605a1f22403c1e1a16", "parents": [ "ad3b6178788d980f25b77a9fed7d7a63c2e391e5" ], "author": { "name": "Egor Pasko", "email": "pasko@chromium.org", "time": "Mon Jul 06 13:30:50 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jul 06 13:32:33 2026" }, "message": "PartitionAlloc: Remove StackTopRegistry notification\n\nIn PartitionAllocSupport::ReconfigureAfterFeatureListInit() we populate\nStackTopRegistry with information about the main thread stack (via\nGetStackTop()). In Bionic (and Glibc) on main thread this requires\nscanning `/proc/self/maps`, which is going through VMAs for the current\nprocess and parsing each line with sscanf().\n\nThe scanning does not happen for non-main threads (the ones coming from\npthread_create()) - they know the thread attributes from the start.\n\nThis VMA scan is noticeable in our startup traces on Android via perf\nsampling. This blocks early startup by \u003e10ms on some slow devices.\n\nSome time ago the StackTopRegistry was useful for PCScan experiments,\nbut this data is not used now.\n\nMore detailed motivation: https://crbug.com/518605818#comment21.\n\nOnly remove the GetStackTop() call to allow easier cherrypicking to\nother channels. Leave out cleanup in StackTopRegistry and stack scanning\nfunctionality for a separate commit.\n\nBug: 518605818, 530922114\nChange-Id: I01f7b811f7ff9180c6824361f44296fb6329d274\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8040564\nReviewed-by: Benoit Lize \u003clizeb@chromium.org\u003e\nCommit-Queue: Egor Pasko \u003cpasko@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1657146}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: f216d460d8bece68089b58bba99805b818862437\n" }, { "commit": "ad3b6178788d980f25b77a9fed7d7a63c2e391e5", "tree": "fcb0940742e636ebeba063a3dac7193f1917e9fe", "parents": [ "2723da2d1b2cc49feb9848a6e44fdf9681b8c123" ], "author": { "name": "Egor Pasko", "email": "pasko@chromium.org", "time": "Mon Jul 06 11:22:47 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jul 06 11:24:59 2026" }, "message": "PartitionAlloc: Fix component (for bugs) in DIR_METADATA\n\nBug: None\nChange-Id: I5e1cbaa85bfeeb2011f32ce188acd0c58ec5e0f2\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8036087\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Egor Pasko \u003cpasko@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1657097}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 1eecfbdbd64d9fec5117774a88ba3a76b407d51b\n" }, { "commit": "2723da2d1b2cc49feb9848a6e44fdf9681b8c123", "tree": "c3a764626449a91b3fc5efcfc7395738dd0c8045", "parents": [ "0e08e2939ca77100e918d4dcdb4b39bc51ca1d9f" ], "author": { "name": "Daniel Angulo", "email": "angdaniel@google.com", "time": "Tue Jun 30 21:57:32 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jun 30 21:59:21 2026" }, "message": "Spanification of cc/metrics/scroll_jank_v4_tracing_recorder.cc, etc.\n\nThis is the result of running the automatic spanification on linux and\nupdating code to use and pass spans where size is known.\n\nThe original patch was fully automated using script:\n//tools/clang/spanify/rewrite-multiple-platforms.sh -platforms\u003dlinux\nThen refined with gemini-cli and at last manually refined\n\nGemini-CLI auto-fixes for compilation\n\nBug: 505042664\nChange-Id: I0bed908b154a443df50058d4b1f2ffae25ad7a0f\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7833932\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nCommit-Queue: Daniel Angulo \u003cangdaniel@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1655076}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 7efef26e6d03091da91c59ea0422d8a5476d1040\n" }, { "commit": "0e08e2939ca77100e918d4dcdb4b39bc51ca1d9f", "tree": "0432331a857ff321842de4aa7909f30c576dd5cc", "parents": [ "009c3b60a1c149c0f4f241150c993b2032487829" ], "author": { "name": "Takashi Sakamoto", "email": "tasak@google.com", "time": "Mon Jun 29 07:36:49 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Mon Jun 29 07:38:39 2026" }, "message": "PA: Record type_id and size at intended leak\n\nAdd unordered_map whose keys are LeakedSecurityObjects\u0027 `type id` and\nvalues are total sizes of leaked memory per the `type id`.\n\nBug: 501113274\nChange-Id: Icbc80acc770d8ce8352c7ef858c884284ce971f0\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7931207\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nReviewed-by: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1653895}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 368e2fc0a633d31c750c8cbb2f1a5661a231c143\n" }, { "commit": "009c3b60a1c149c0f4f241150c993b2032487829", "tree": "f640c7a05ec1ea3572d0c6e15a6caeec5f007cbd", "parents": [ "c55a8737c51a989eeef17683316a1cb29e92abde" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Fri Jun 26 22:19:31 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Fri Jun 26 22:21:55 2026" }, "message": "Add alignment parameter to PartitionAllocHooks::AllocationOverrideHook.\n\nA crash has been seen in Audio code which we suspect is due to it\nrequesting 32 alignment, but when it gets selected to be sampled by\nGWP-ASAN this requirement is lost and it falls back to the default\nGWP-ASAN alignment of 16.\n\nThe AllocationOverrideHook now receives the requested alignment. The\nGWP-Asan sampling shim is updated to use this alignment when calling its\ninternal allocator, and a new test case is added to verify correct\nhandling of aligned allocations.\n\nBug: 506860289\nChange-Id: I14fcda98520e9749764140cc2eccdafe176e9113\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7838366\nReviewed-by: Matthew Denton \u003cmpdenton@chromium.org\u003e\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Matthew Denton \u003cmpdenton@chromium.org\u003e\nReviewed-by: Kalvin Lee \u003ckdlee@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1653490}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 8240bdc725e172b0b33ebd4b779867a72e3f50c4\n" }, { "commit": "c55a8737c51a989eeef17683316a1cb29e92abde", "tree": "4799e3a851cd6ac5f238f2e1fc1da45ef3dabd9d", "parents": [ "dbf94f594fe4ead61a89636efda80756693ea303" ], "author": { "name": "Xiaobin Cui", "email": "xiaobincui@microsoft.com", "time": "Thu Jun 25 04:43:59 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jun 25 04:45:55 2026" }, "message": "[ios blink] Use CCRandomGenerateBytes instead of /dev/urandom on iOS\n\niOS 27 app extension sandboxes (content process, GPU process) block\nopen(\"/dev/urandom\"), causing a CHECK failure.\n\nUse CCRandomGenerateBytes from CommonCrypto on iOS.\n\nBug: 40641285, 411013545\nChange-Id: I839ae46402e49d9b4f574fb8739dbb5f1aa81050\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7949557\nReviewed-by: Dave Tapuska \u003cdtapuska@chromium.org\u003e\nReviewed-by: David Benjamin \u003cdavidben@chromium.org\u003e\nCommit-Queue: Xiaobin Cui \u003cxiaobincui@microsoft.com\u003e\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1652168}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 31f98d9b640be769dc3f06301f89205a7f504eda\n" }, { "commit": "dbf94f594fe4ead61a89636efda80756693ea303", "tree": "c3767eb2a78863e32b5f396efd5238e669f4d6f4", "parents": [ "d259883ed21e8b78c182b0b086ec16b28187e17d" ], "author": { "name": "Jordan Brown", "email": "rop@google.com", "time": "Thu Jun 25 02:35:29 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jun 25 02:37:13 2026" }, "message": "Set \u0027License Android Compatible\u0027 for deps with reciprocal licenses\n\nThis field indicates they are meeting the reciprocal requirements of\ntheir licenses. To _not_ meet this requirement they would have to be in\nan internal component with changes that are not publicly accessible.\n\nChange-Id: I6187d29fd221992047e4859a0a560a512f970e2a\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7977661\nReviewed-by: Jiewei Qian \u003cqjw@chromium.org\u003e\nReviewed-by: Rachael Newitt \u003crenewitt@google.com\u003e\nAuto-Submit: Jordan Brown \u003crop@google.com\u003e\nOwners-Override: Jordan Brown \u003crop@google.com\u003e\nCommit-Queue: Jordan Brown \u003crop@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1652137}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 60b9ee56f4f7122464511c190e239ed53688a2bc\n" }, { "commit": "d259883ed21e8b78c182b0b086ec16b28187e17d", "tree": "2c393ac087b71c1da8239110c941a136a8e7e923", "parents": [ "9cb253508b3d72e24754b8c394a2a21704c5e389" ], "author": { "name": "Takashi Sakamoto", "email": "tasak@google.com", "time": "Thu Jun 25 02:31:24 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jun 25 02:34:01 2026" }, "message": "Make leaked security objects provide type-id at `delete`.\n\nThe type-id should be:\n- computed at compile time (not to affect non-leaked security objects)\n- static between different chrome version (make it easy to see how the number of crash reports with each type id changes)\n\nTo generate type-id, add fnv1a_consteval.h under partition_root.h (not\n//base/hash, because the hash is used only for the type-id). The key\nwill be replaced with AllocToken later. Once AllocToken is available, we\nwill remove the code immediately.\n\nBug: 501113274\nChange-Id: I479762c9d07fbf56531d9c4d1755c8bbb0bbf3ba\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7785069\nReviewed-by: Daniel Cheng \u003cdcheng@chromium.org\u003e\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1652136}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 829e32632b4905d48816cc90787e51ad5f16224b\n" }, { "commit": "9cb253508b3d72e24754b8c394a2a21704c5e389", "tree": "69660953d6f31fe281cee746531baf7f98ebe0f4", "parents": [ "17f0175f38a2f262e8da9e6da5bc64605d62266f" ], "author": { "name": "Takashi Sakamoto", "email": "tasak@google.com", "time": "Wed Jun 24 09:15:17 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jun 24 09:17:11 2026" }, "message": "[PA] Disallow ++refcount once the object is not held by allocator and its refcount is zero\n\nOnce an object is not held by allocator and its refcount is equal to\nzero, we should not allow to increment its refcount. If allows, refcount\ncould become zero multiple times (if DCHECK is enabled, it will be\nblocked but IS_OFFICIAL disables DCHECK) and FreeAfterQuarantine() will\nbe invoked multiple times. This will cause\n`PA_CHECK(num_allocated_slots)` failure later and will make it difficult\nto debug crash dumps.\n\nBug: 501113274\nChange-Id: I8db044bea5560af180841d76355be7b3906d67b4\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7983185\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCommit-Queue: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1651586}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 1c560f669210aee5b34d81907aae4813163d513c\n" }, { "commit": "17f0175f38a2f262e8da9e6da5bc64605d62266f", "tree": "9e9c41d4dd928871779d23c569eaa3abb5b92ebb", "parents": [ "64c90fe7e89e33404f23458edf813acee2d14b2b" ], "author": { "name": "Keishi Hattori", "email": "keishi@google.com", "time": "Wed Jun 24 07:03:23 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jun 24 07:05:10 2026" }, "message": "Report unprotected-in-release raw_ptr correctly in BRP-ASan\n\nA raw_ptr\u003cT, kUnprotectedInRelease\u003e fields shall not be reported as PROTECTED by BRP ASAN.\n\n- Add a dedicated, persistent RawPtrTraits::kIsUnprotectedInRelease bit.\n\n- V1 (RawPtrAsanService): thread the bit through RawPtrHookableImpl\u0027s\n dereference/extraction hooks into PendingReport, and report a new\n ProtectionStatus::kUnprotectedInRelease (\"NOT PROTECTED IN RELEASE\n BUILD\").\n\n- V2: thread the bit through wrap/release/duplicate hooks; track\n unprotected-in-release references (unprotected_in_release_count) separately from\n protective ones (count) in AllocationMetadata. CheckLog and\n CheckFaultAddress report kUnprotectedInRelease for allocations\n kept alive only by unprotected-in-release refs\n (new IsUnprotectedInReleaseOnly() helper).\n\nTAG\u003dagy\nCONV\u003d39447045-9d01-470d-9c95-0245bd715b3d\n\nChange-Id: I8772d446ac04b536218c263fbf797261619ea2bb\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7989298\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCommit-Queue: Keishi Hattori \u003ckeishi@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1651532}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e20ea3ba8cb0e2c66d0f03b2542cd8eb8b4efc03\n" }, { "commit": "64c90fe7e89e33404f23458edf813acee2d14b2b", "tree": "1d7a73b05a7f3a828b3b4f7560ff6eb26adb5815", "parents": [ "4e256afb47b4ed846f38e9653aada344613bf754" ], "author": { "name": "Kevin Graney", "email": "kmg@google.com", "time": "Tue Jun 23 14:15:51 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Tue Jun 23 14:18:08 2026" }, "message": "Set kPartitionCachelineSize to 128B for Apple ARM\n\nAll Apple ARM chips have a 128B L2 cache, and to avoid false-sharing\nit\u0027s recommended to use 128B cache lines (even though L1D is 64B) [1].\n\nImprovements in base_perftest on M4 for memory allocation:\nhttps://screenshot.googleplex.com/6aCSoP3J2qYTeAS\nhttps://pinpoint-dot-chromeperf.appspot.com/job/1749f5bcc90000\n\n[1]: https://screenshot.googleplex.com/4VebcpHhNC8ri87\n\nBug: 526970924\nChange-Id: Ib0d6f75489cc31163abca3f3b7c143b553caaaf8\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7964200\nCommit-Queue: Kevin Graney \u003ckmg@google.com\u003e\nReviewed-by: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1650980}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 464033acd00955c8dbd0fb41e5348e9568d2938a\n" }, { "commit": "4e256afb47b4ed846f38e9653aada344613bf754", "tree": "337c9e8125e71102d382210f0dc20f15f1e8bfbc", "parents": [ "f0ef8b98f936ad62194ec994e36fb36c81808212" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Thu Jun 18 07:55:24 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Thu Jun 18 07:57:16 2026" }, "message": "Enable use_checked_span on Linux.\n\nThe `!is_linux` condition is removed from the `use_checked_span`\ndefinition in partition_alloc.gni, allowing checked spans to be used on\nLinux builds when other conditions are met.\n\nPreviously we were seeing timeouts on linux-rel, but we have verified in\ncrrev.com/c/7956137 that no tests fail once the timeout limits are\nlifted. And apparently it was just a \"yesterday\" thing with linux-rel,\nbecause it doesn\u0027t fail now either.\n\nChange-Id: If469da15b9c0ccc41a7e3efe2bf984765d4ebf8c\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7958255\nCommit-Queue: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Kalvin Lee \u003ckdlee@chromium.org\u003e\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1648847}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: e9e5fff111ff50dfa4ae3acbbb05936eeb998782\n" }, { "commit": "f0ef8b98f936ad62194ec994e36fb36c81808212", "tree": "50e4232c3b3c272661cd663abf85d04b5ebc2747", "parents": [ "94cee1e9f648f6c0a5e2d5cf68dece431c440725" ], "author": { "name": "mikt", "email": "mikt@google.com", "time": "Wed Jun 17 12:23:07 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jun 17 12:24:35 2026" }, "message": "[PA] Fix ThreadCache corruption in ThreadCacheProcessScopeForTesting\n\nThreadCacheProcessScopeForTesting is used in tests to temporarily\ndisable the default allocator\u0027s thread cache and enable it for a\ntest-specific allocator root.\n\nHowever, its destructor failed to disable the thread cache on the\ntest-specific root. When the test-specific allocator was subsequently\ndestroyed, its DeleteForTesting call saw that the thread cache was\nstill enabled, and incorrectly called SwapForTesting(nullptr, 0)\n(since it was still configured for index 0). This cleared the global\ng_thread_cache_roots[0] to nullptr and deleted the active thread\ncache of the default allocator (which had just been restored).\n\nThis left the default allocator in a corrupted state, causing\nsubsequent tests in the same process to crash when they attempted to\nuse the thread cache (e.g., when initializing BrowserTaskEnvironment\nwith the quarantine observer enabled).\n\nThis issue was only visible on Android because Android runs all tests\nin the same process, so the global state corruption persisted across\ntests. Other platforms run tests in forked processes.\n\nThis CL fixes the issue by ensuring ThreadCacheProcessScopeForTesting\ndestructor explicitly disables the thread cache on the test-specific\nroot. It also adds a regression test.\n\nTAG\u003dagy\nCONV\u003d4cfbc050-74f1-43df-a6e9-60cd3d54a8c6\n\nBug: 522974278\nChange-Id: I36b2892b56159e1d1f94054e771dc52b627d8eee\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7949997\nCommit-Queue: Mikihito Matsuura \u003cmikt@google.com\u003e\nReviewed-by: Arthur Sonzogni \u003carthursonzogni@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nCr-Commit-Position: refs/heads/main@{#1648229}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 20bd2b24c1113117042e85fd1b75fb30d31257c8\n" }, { "commit": "94cee1e9f648f6c0a5e2d5cf68dece431c440725", "tree": "209aefa6342f33b2c6e047c76d28983958cd8b05", "parents": [ "913b255cfd21fbaba5d2acf06c1c172d221139dc" ], "author": { "name": "Stephen Nusko", "email": "nuskos@chromium.org", "time": "Wed Jun 17 10:00:22 2026" }, "committer": { "name": "Copybara-Service", "email": "copybara-worker@google.com", "time": "Wed Jun 17 10:02:12 2026" }, "message": "Handle nullptr buckets in SlotSpans\n\nThrough comment-out-the-impl bisection, we determine that\n`SlotAddressAndSize::From()` is crashing. For reasons we don\u0027t\nunderstand, `bucket` is sometimes a nullptr when we don\u0027t expect it to\nbe. Dereferencing it causes a crash (luckily).\n\nThis CL works around the issue by pretending that such an extent is\nconsidered in bounds. Additionally, we attempt to default-enable Checked\nSpan again, this time without platform gating.\n\nNote excluding linux for now due to timeouts (don\u0027t see any crashes\nthough).\n\nRepro notes ---\n\n* These `headless_shell_wpt_tests` failures were first seen on\n Windows, providing us the impetus to gate on `!is_win`. However,\n we never managed to repro directly, and the set of failing tests\n was not consistent.\n\n* A little before this point, Mac failures were somewhat consistent,\n but hardware / visibility constraints of the test harness prevented\n us from chasing the issue efficiently.\n\n* We have a consistent repro now for a `linux-rel` setup.\n\nReproducing on linux-rel ---\n\nAt 549fba73e91a0223bde98979bc3ab45905d337c1, we can get a pretty\nconsistent crash out of\nexternal/wpt/fledge/tentative/private-aggregation.https.window.html?16-20\n. Using `symbol_level \u003d 2` improves the stack slightly, but not by much.\n\n```\n(lldb) bt\n* thread #1, name \u003d \u0027chromedriver\u0027, stop reason \u003d SIGSEGV: address not mapped to object (fault address\u003d0x18)\n * frame #0: 0x0000558eaf041c67 chromedriver`partition_alloc::SlotAddressAndSize::From(address\u003d\u003cunavailable\u003e, pool\u003d\u003cunavailable\u003e) at slot_address_and_size.cc:86:19\n frame #1: 0x0000558eaf02c47a chromedriver`partition_alloc::IsExtentOutOfBounds(ptr\u003d\u003cunavailable\u003e, extent_bytes\u003d0, type_size\u003d1) at bounds_checks.cc:31:26\n frame #2: 0x0000558eaec7638a chromedriver`net::GrowableIOBuffer::set_offset(this\u003d0x00002ac8000fe160, offset\u003d\u003cunavailable\u003e) at span.h:1097:16\n frame #3: 0x0000558eaef094d5 chromedriver`net::HttpConnection::ReadIOBuffer::DidRead(this\u003d0x00002ac8000fe130, bytes\u003d\u003cunavailable\u003e) at http_connection.cc:63:10\n frame #4: 0x0000558eaef07ebf chromedriver`net::HttpServer::HandleReadResult(this\u003d0x00002ac8001451a0, connection\u003d0x00002ac8000fdd40, rv\u003d\u003cunavailable\u003e) at http_server.cc:249:13\n frame #5: 0x0000558eaef07dde chromedriver`net::HttpServer::DoReadLoop(this\u003d0x00002ac8001451a0, connection\u003d0x00002ac8000fdd40) at http_server.cc:229:10\n frame #6: 0x0000558eaee070e3 chromedriver`net::TCPClientSocket::DidCompleteRead(this\u003d\u003cunavailable\u003e, result\u003d\u003cunavailable\u003e) at callback.h:155:12\n frame #7: 0x0000558eaeeee4c5 chromedriver`net::TCPSocketPosix::ReadCompleted(this\u003d\u003cunavailable\u003e, buf\u003d\u003cunavailable\u003e, callback\u003dnet::CompletionOnceCallback @ 0x00007f9710bfc5f8, rv\u003d512) at callback.h:155:12\n frame #8: 0x0000558eaeeef2d7 chromedriver`void base::internal::InvokeHelper\u003cfalse, base::internal::FunctorTraits\u003cvoid (net::TCPSocketPosix::*\u0026\u0026)(scoped_refptr\u003cnet::IOBuffer\u003e const\u0026, base::OnceCallback\u003cvoid (int)\u003e, int), net::TCPSocketPosix*, scoped_refptr\u003cnet::IOBuffer\u003e\u0026\u0026, base::OnceCallback\u003cvoid (int)\u003e\u0026\u0026\u003e, void, 0ul, 1ul, 2ul\u003e::MakeItSo\u003cvoid (net::TCPSocketPosix::*)(scoped_refptr\u003cnet::IOBuffer\u003e const\u0026, base::OnceCallback\u003cvoid (int)\u003e, int), std::__Cr::tuple\u003cbase::internal::UnretainedWrapper\u003cnet::TCPSocketPosix, base::unretained_traits::MayNotDangle, (partition_alloc::internal::RawPtrTraits)0\u003e, scoped_refptr\u003cnet::IOBuffer\u003e, base::OnceCallback\u003cvoid (int)\u003e\u003e, int\u003e(functor\u003d0x00002ac8000dab40, bound\u003dsize\u003d3, args\u003d\u003cunavailable\u003e) at bind_internal.h:740:12 [inlined]\n frame #9: 0x0000558eaeef0688 chromedriver`net::SocketPosix::RetryRead(this\u003d\u003cunavailable\u003e, rv\u003d512) at callback.h:155:12\n frame #10: 0x0000558eaeef0d93 chromedriver`net::SocketPosix::OnFileCanReadWithoutBlocking(this\u003d\u003cunavailable\u003e, fd\u003d\u003cunavailable\u003e) at callback.h:155:12\n frame #11: 0x0000558eaf01aa10 chromedriver`base::MessagePumpEpoll::FdWatchController::OnFdReadable(this\u003d\u003cunavailable\u003e) at message_pump_epoll.cc:760:13 [inlined]\n frame #12: 0x0000558eaf01a9fb chromedriver`base::MessagePumpEpoll::HandleEvent(this\u003d0x00002ac8000a0240, fd\u003d9, can_read\u003dtrue, can_write\u003dfalse, controller\u003d0x00002ac800021870) at message_pump_epoll.cc:668:17\n frame #13: 0x0000558eaf01a71c chromedriver`base::MessagePumpEpoll::OnEpollEvent(this\u003d0x00002ac8000a0240, entry\u003d0x00002ac8001455e8, events\u003d1) at message_pump_epoll.cc:614:7\n frame #14: 0x0000558eaf019f88 chromedriver`base::MessagePumpEpoll::WaitForEpollEvents(this\u003d0x00002ac8000a0240, timeout\u003dTimeDelta @ scalar) at message_pump_epoll.cc:506:7\n frame #15: 0x0000558eaf019a5f chromedriver`base::MessagePumpEpoll::Run(this\u003d0x00002ac8000a0240, delegate\u003d0x00002ac800044900) at message_pump_epoll.cc:285:5\n frame #16: 0x0000558eaefc9294 chromedriver`base::sequence_manager::internal::ThreadControllerWithMessagePumpImpl::Run(this\u003d0x00002ac800044900, application_tasks_allowed\u003dtrue, timeout\u003d\u003cunavailable\u003e) at thread_controller_with_message_pump_impl.cc:657:12\n frame #17: 0x0000558eaef9c7f1 chromedriver`base::RunLoop::Run(this\u003d0x00007f9710bfcb90, location\u003d0x00007f9710bfcb50) at run_loop.cc:135:14\n frame #18: 0x0000558eaeff1e28 chromedriver`base::Thread::Run(this\u003d\u003cunavailable\u003e, run_loop\u003d0x00007f9710bfcb90) at thread.cc:356:13\n frame #19: 0x0000558eaeff1f8b chromedriver`base::Thread::ThreadMain(this\u003d0x00007ffc3dae3c50) at thread.cc:426:3\n frame #20: 0x0000558eaf0047ea chromedriver`base::(anonymous namespace)::ThreadFunc(params\u003d\u003cunavailable\u003e) at platform_thread_posix.cc:102:13\n frame #21: 0x00007f9712495dc9 libc.so.6`start_thread(arg\u003d\u003cunavailable\u003e) at pthread_create.c:448:8\n frame #22: 0x00007f9712514d88 libc.so.6`__clone3 at clone3.S:78\n(lldb) fr v bucket\n(partition_alloc::internal::PartitionBucket *) bucket \u003d nullptr\n(lldb) fr v -fx\n(uintptr_t) address \u003d \u003ccould not evaluate DW_OP_entry_value: no call edge for retn-pc \u003d 0x558eaf02c47a in parent frame partition_alloc::IsExtentOutOfBounds(void const*, unsigned long, unsigned long)\u003e\n\n(partition_alloc::internal::pool_handle) pool \u003d \u003ccould not evaluate DW_OP_entry_value: no call edge for retn-pc \u003d 0x558eaf02c47a in parent frame partition_alloc::IsExtentOutOfBounds(void const*, unsigned long, unsigned long)\u003e\n\n(partition_alloc::SlotAddressAndSize) directmap_slot_info \u003d \u003cvariable not available\u003e\n\n(std::ptrdiff_t) metadata_offset \u003d 0x000012152ab61000\n(partition_alloc::internal::SlotSpanMetadata *) slot_span \u003d \u003cvariable not available\u003e\n\n(partition_alloc::internal::SlotSpanStart) slot_span_start \u003d (address_ \u003d 0x00002ac8004ec000)\n(size_t) offset_in_slot_span \u003d 0x0000000000000000\n(partition_alloc::internal::PartitionBucket *) bucket \u003d nullptr\n```\n\nBug: 501113358\nChange-Id: I36f1d251cd2b72ad81cc61d2779b830c798c3be1\nReviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7953898\nCommit-Queue: Stephen Nusko \u003cnuskos@chromium.org\u003e\nReviewed-by: Takashi Sakamoto \u003ctasak@google.com\u003e\nAuto-Submit: Stephen Nusko \u003cnuskos@chromium.org\u003e\nCr-Commit-Position: refs/heads/main@{#1648183}\nNOKEYCHECK\u003dTrue\nGitOrigin-RevId: 6f62d97e29b95f702d2554e39d3f114e67ae50d3\n" } ], "next": "913b255cfd21fbaba5d2acf06c1c172d221139dc" }