Skip to content

Fix leaked raw_ptr/raw_ref in BraveOriginService#34275

Merged
bbondy merged 1 commit intobrave:masterfrom
netzenbot:fix-brave-origin-service-dangling-ptr
Mar 1, 2026
Merged

Fix leaked raw_ptr/raw_ref in BraveOriginService#34275
bbondy merged 1 commit intobrave:masterfrom
netzenbot:fix-brave-origin-service-dangling-ptr

Conversation

@netzenbot
Copy link
Collaborator

Summary

Override KeyedService::Shutdown() in BraveOriginService to prevent dangling raw_ptr references detected at test teardown.

Resolves brave/brave-browser#52757

Root Cause

BraveOriginService stores raw_ptr members to PrefService and PolicyService objects that are destroyed during the profile teardown sequence before the service's destructor runs. With the defaulted destructor, these raw_ptr members detect dangling references when PartitionAlloc checks them at destruction time, causing a fatal CHECK failure.

Fix

Override KeyedService::Shutdown() to:

  1. Invalidate weak pointers first (preventing pending callbacks from firing on partially-destroyed state)
  2. Reset the Mojo remote for SKU service
  3. Null out all non-owned raw_ptr members (local_state_, profile_prefs_, profile_policy_service_, browser_policy_service_)

This follows the established Chromium pattern for KeyedService cleanup (CSM-016, CSM-017).

Test Plan

  • Ran npm run format - passed
  • Ran npm run build - passed
  • Ran npm run gn_check - passed
  • Ran npm run presubmit - passed (warnings unrelated to this change)
  • Ran BraveOriginServiceFactory unit tests - passed (5/5)
  • Ran BraveExtensionsManifestV2BrowserTest.InstallDisableEnableUninstall (original failing test) - passed
  • CI passes cleanly

@netzenbot netzenbot self-assigned this Feb 27, 2026
Override KeyedService::Shutdown() to clean up raw_ptr members and
invalidate weak pointers before the service is destroyed. Without
this, the defaulted destructor detects dangling raw_ptr references
to PrefService and PolicyService objects that are already freed
during the profile teardown sequence.

Resolves brave/brave-browser#52757
@netzenbot netzenbot force-pushed the fix-brave-origin-service-dangling-ptr branch from f40cfd4 to 7c5993b Compare February 27, 2026 19:55
@bbondy bbondy marked this pull request as ready for review February 27, 2026 20:00
@bbondy bbondy requested a review from atuchin-m February 27, 2026 20:00
@netzenbot
Copy link
Collaborator Author

👋 Friendly reminder: This PR has been waiting for review for over 24 hours.

@atuchin-m When you have a moment, could you please take a look? Thank you!

(I was asked to send reminders for PRs waiting more than a day)

@atuchin-m
Copy link
Collaborator

@bbondy Does it make sense to uplift it? It's not a test-only issue.

@bbondy
Copy link
Member

bbondy commented Mar 1, 2026

Probably not worth uplifting. It's disabled via a flag too

@bbondy bbondy merged commit 95f9917 into brave:master Mar 1, 2026
31 of 33 checks passed
@brave-builds
Copy link
Collaborator

Released in v1.89.89

bbondy pushed a commit that referenced this pull request Mar 2, 2026
Override KeyedService::Shutdown() to clean up raw_ptr members and
invalidate weak pointers before the service is destroyed. Without
this, the defaulted destructor detects dangling raw_ptr references
to PrefService and PolicyService objects that are already freed
during the profile teardown sequence.

Resolves brave/brave-browser#52757
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Brave Origin] Leaked raw_ptr/raw_ref in BraveOriginService

4 participants