commit 59ef22c05abe9c5a32c84fceb32ef320712930bb
author Michelle Abreo <michelleabreo@google.com> Wed Jun 25 13:23:30 2025
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Wed Jun 25 13:23:30 2025
tree e45d48cf0265a4168244defac612c62921dd5e75
parent fe1dc082014a4a245a66ea1603450521a9e50e35

Defer reload in CookieControls bubble to fix race condition.

PROBLEM
A crash would occur when the user triggered the reloading UI, which
starts a spinner animation and immediately begins a page reload.

CAUSE
The spinner (Throbber) uses a timer with callbacks bound to a WeakPtr.
If Reload is triggered immediately after the user presses the button,
the associated widget/view may be destroyed before the timer stops. This
leads to a use-after-free when the Throbber tries to schedule paint
callbacks on a now-invalidated widget.

FIX
This change serializes these operations, and the `Reload()` call is now
deferred. The delayed task callback first stops the spinner animation
and begins closing the bubble. Only after the UI is safely being torn
down is the page reload initiated. A 200ms delay is used to ensure the
spinner is visible before the reload begins.

Note -- this change ends up making the reloading timeout for the TP UI
bubble obsolete (since we close the bubble after a fixed amount of
time). Once I've verified this fix in canary I'll send a followup to
clean up the timeout metrics.

Bug b:425927824

Change-Id: I5bce0bd81a92abc1222734e5ee87375d0b62dad7
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6668278
Reviewed-by: Kevin Graney <kmg@google.com>
Commit-Queue: Michelle Abreo <michelleabreo@google.com>
Cr-Commit-Position: refs/heads/main@{#1478504}