The new ContextAware API will be available in Activity 1.2.0-alpha08 and is used by Fragment 1.3.0-alpha08 and AppCompat 1.3.0-alpha02 to implement FragmentManager's and AppCompatDelegate's pre-onCreate() logic.

Wait, this can't work as advertised.

FragmentActivity extends ComponentActivity

public FragmentActivity(@LayoutRes int contentLayoutId) {
    super(contentLayoutId);
    init();
}

private void init() {
    addOnContextAvailableListener(new OnContextAvailableListener() {
        // ...
    }
}

ComponentActivity

@Override
protected void onCreate(@Nullable Bundle savedInstanceState) {
    // ...
    mContextAwareHelper.dispatchOnContextAvailable(this);
    super.onCreate(savedInstanceState);
    //...
}

1. Call FragmentActivity constructor,
2. which calls ComponentActivity super constructor,
3. which dispatches context available... to noone,
4. and calls platform Activity.onCreate.
5. Bubble up to FragmentActivity constructor and register context listener,
6. which is invoked synchronously but only after platform Activity.onCreate has already been called.

Did I miss something? I'm confused.

Never mind, constructor vs onCreate. :facepalm: Sorry.

Re #8 - the fact that these are different things is indeed exactly why this API exists :)

https://docs.google.com/document/d/1hyftTRyqV7ZJ5s2b_-Q9K6RJdpgedgvKP4vYoTK7i1A/edit?usp=drive_web ([Feedback] Bass Booster)

https://docs.google.com/document/d/1hyftTRyqV7ZJ5s2b_-Q9K6RJdpgedgvKP4vYoTK7i1A/edit?usp=drive_web ([Feedback] Bass Booster)

This is a serious security regression. If you are not able to fix this quickly, please revert the change that introduced it.

If this doesn't affect a release branch, or has not been properly classified for severity, please update the Security Impact hotlist or the Severity field, and remove the ReleaseBlock hotlist.

The latest bisection (for Debug check failed: (heap) != nullptr) results in https://crrev.com/c/4521712 ([interpreter] Enable TDZ elision by default).

Before that, we get ReferenceError: Must call super constructor in derived class before accessing 'this' or returning from derived constructor.

Shu, can you take this one?

TDZ seems to be "temporal dead zone", and from https://crbug.com/42203665 I learned that this is the same as "hole elision" (quote: TDZ elision (aka "hole elision" in the codebase)).

So this seems highly related.

syg: Uh oh! This issue still open and hasn't been updated in the last 14 days. This is a serious vulnerability, and we want to ensure that there's progress. Could you please leave an update with the current status and any potential blockers?

If you're not the right owner for this issue, could you please remove yourself as soon as possible or help us find the right one?

If the issue is fixed or you can't reproduce it, please close the bug. If you've started working on a fix, please set the status to Started.

Thanks for your time! To disable nags, add Disable-Nags (case sensitive) to the Chromium Labels custom field.

Any update?

Sorry I had missed this, taking a look.

Project: v8/v8
Branch: main
Author: Shu-yu Guo <syg@chromium.org>
Link:      https://chromium-review.googlesource.com/6032225

[interpreter] Fix hole elision scope for switch jump tables

[interpreter] Fix hole elision scope for switch jump tables 
 
Fixed: 374627491 
Change-Id: I7b6142b45295ba795a8ae8a90692fc09e704b65d 
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6032225 
Reviewed-by: Leszek Swirski <leszeks@chromium.org> 
Commit-Queue: Shu-yu Guo <syg@chromium.org> 
Cr-Commit-Position: refs/heads/main@{#97274}

Security Merge Request Consideration: This is sufficiently serious that it should be merged to beta. But I can't see a Chromium repo commit here,so you will need to investigate what - if anything - needs to be merged to M132. Is there a fix in some other repo which should be merged? Or, perhaps this ticket is a duplicate of some other ticket which has the real fix: please track that down and ensure it is merged appropriately. Security Merge Request: Thank you for fixing this security bug! We aim to ship security fixes as quickly as possible, to limit their opportunity for exploitation as an "n-day" (that is, a bug where git fixes are developed into attacks before those fixes reach users).

We have determined this fix is necessary on milestone(s): [].

Please answer the following questions so that we can safely process this merge request:

1. Which CLs should be backmerged? (Please include Gerrit links.)
2. Has this fix been verified on Canary to not pose any stability regressions?
3. Does this fix pose any potential non-verifiable stability risks?
4. Does this fix pose any known compatibility risks?
5. Does it require manual verification by the test team? If so, please describe required testing.
6. (no answer required) Please check the OS custom field to ensure all impacted OSes are checked!

Merge review required: M132 is already shipping to beta.

Please answer the following questions so that we can safely process your merge request:

1. Why does your merge fit within the merge criteria for these milestones?

• Chrome Browser: https://chromiumdash.appspot.com/branches
• Chrome OS: https://goto.google.com/cros-release-branch-merge-guidelines

2. What changes specifically would you like to merge? Please link to Gerrit.
3. Have the changes been released and tested on canary?
4. Is this a new feature? If yes, is it behind a Finch flag and are experiments active in any release channels?
5. [Chrome OS only]: Was the change reviewed and approved by the Eng Prod Representative? https://goto.google.com/cros-engprodcomponents
6. If this merge addresses a major issue in the stable channel, does it require manual verification by the test team? If so, please describe required testing.

Please contact the milestone owner if you have questions. Owners: govind (Android), govind (iOS), alonbajayo (ChromeOS), srinivassista (Desktop)

1. It is a security bug fix.
2. https://chromium-review.googlesource.com/c/v8/v8/+/6032225
3. Yes
4. No, not a new feature.
5. N/A
6. No manual verification needed.

https://crrev.com/c/6032225 approved for merge to 132;

Please merge this fix to 13.2 at your convenience and by EOD 3 December, so this fix can be included in the next M132 beta update following the current release freeze

Project: v8/v8
Branch: refs/branch-heads/13.2
Author: Shu-yu Guo <syg@chromium.org>
Link:      https://chromium-review.googlesource.com/6042925

Merged: [interpreter] Fix hole elision scope for switch jump tables

Merged: [interpreter] Fix hole elision scope for switch jump tables 
 
(cherry picked from commit 5c3b50c26c50e68dbedf8ff991249e75e46ef06e) 
 
Change-Id: Id6bf2b62598b85a05c6cc7bd06b6cce673d7342a 
Bug: 374627491 
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6042925 
Commit-Queue: Shu-yu Guo <syg@chromium.org> 
Commit-Queue: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> 
Auto-Submit: Shu-yu Guo <syg@chromium.org> 
Reviewed-by: Rezvan Mahdavi Hezaveh <rezvan@chromium.org> 
Cr-Commit-Position: refs/branch-heads/13.2@{#18} 
Cr-Branched-From: 24068c59cedad9ee976ddc05431f5f497b1ebd71-refs/heads/13.2.152@{#1} 
Cr-Branched-From: 6054ba94db0969220be4f94dc1677fc4696bdc4f-refs/heads/main@{#97085}

According the impacts analysis of CF, this bug affect 'Extended_Stable 130.0.6723.127' and 'Stable 131.0.6778.69'. So will this issue get CVE?

LTS Milestone M126

This issue has been flagged as a merge candidate for Chrome OS' LTS channel. If selected, our merge team will handle any additional merges. To help us determine if this issue requires a merge to LTS, please answer this short questionnaire:

1. Was this issue a regression for the milestone it was found in?
2. Is this issue related to a change or feature merged after the latest LTS Milestone?

For the LTS questions:

1. Yes. AFAICT this has been present since M114 (https://chromiumdash.appspot.com/commit/da0bcffa3d0c86cb992250f160c32302e54fb557)
2. No. See above.

This issue requires additional review before it can be merged to the LTS channel. Please answer the following questions to help us evaluate this merge:

1. Number of CLs needed for this fix and links to them.
2. Level of complexity (High, Medium, Low - Explain)
3. Has this been merged to a stable release? beta release?
4. Overall Recommendation (Yes, No)

This issue has been approved for a merge. Please merge the fix to any appropriate branches as soon as possible!

If all merges have been completed, please remove any remaining Merge-Approved labels from this issue.

Thanks for your time! To disable nags, add Disable-Nags (case sensitive) to the Chromium Labels custom field.

Congratulations! Thank you for your efforts and reporting this issue to us.

Thank you Amy. BTW, please answer the #c24, because the foundin of this issue seems not complete

Ack, this is a pretty old bug. https://crrev.com/c/4521712 landed in M-115, and https://crrev.com/c/4405039 in M-114 (also see #c26).

Project: v8/v8
Branch: refs/branch-heads/12.6
Author: Gyuyoung Kim <qkim@google.com>
Link:      https://chromium-review.googlesource.com/6048230

[M126-LTS][interpreter] Fix hole elision scope for switch jump tables

[M126-LTS][interpreter] Fix hole elision scope for switch jump tables 
 
(cherry picked from commit 5c3b50c26c50e68dbedf8ff991249e75e46ef06e) 
 
Fixed: 374627491 
Change-Id: I7b6142b45295ba795a8ae8a90692fc09e704b65d 
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6032225 
Reviewed-by: Leszek Swirski <leszeks@chromium.org> 
Commit-Queue: Shu-yu Guo <syg@chromium.org> 
Cr-Original-Commit-Position: refs/heads/main@{#97274} 
Reviewed-on: https://chromium-review.googlesource.com/c/v8/v8/+/6048230 
Reviewed-by: Shu-yu Guo <syg@chromium.org> 
Commit-Queue: Gyuyoung Kim (xWF) <qkim@google.com> 
Cr-Commit-Position: refs/branch-heads/12.6@{#84} 
Cr-Branched-From: 3c9fa12db3183a6f4ea53d2675adb66ea1194529-refs/heads/12.6.228@{#2} 
Cr-Branched-From: 981bb15ba4dbf9e2381dfc94ec2c4af0b9c6a0b6-refs/heads/main@{#93835}

This bug has been closed for more than 14 weeks. Removing issue access restrictions.