From c24bb170bc654b5db62de638e93a37dc38a900c0 Mon Sep 17 00:00:00 2001
From: Avi Drissman <[email protected]>
Date: Tue, 19 May 2026 14:25:54 -0700
Subject: [PATCH] Clear danging pointers

When a tool tip is detached, clear out _trackingRectUserData.

Fixed: 503790201
Change-Id: I1d24cf8bd81cdb390397903f8df76e596a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7858673
Reviewed-by: Bryan Oltman <[email protected]>
Auto-Submit: Avi Drissman <[email protected]>
Commit-Queue: Bryan Oltman <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1633109}
---

diff --git a/ui/base/cocoa/tool_tip_base_view.mm b/ui/base/cocoa/tool_tip_base_view.mm
index dfe52a1a..a041eb2 100644
--- a/ui/base/cocoa/tool_tip_base_view.mm
+++ b/ui/base/cocoa/tool_tip_base_view.mm
@@ -5,11 +5,13 @@
 #import "ui/base/cocoa/tool_tip_base_view.h"
 
 #include "base/check.h"
+#include "base/check_op.h"
 #include "base/compiler_specific.h"
 #include "base/memory/raw_ptr.h"
 #include "base/notreached.h"
 
 // Below is the nasty tooltip stuff -- copied from WebKit's WebHTMLView.mm
+// https://github.com/WebKit/WebKit/blob/main/Source/WebKitLegacy/mac/WebView/WebHTMLView.mm
 // with minor modifications for code style and commenting.
 //
 //  The 'public' interface is -setToolTipAtMousePoint:. This differs from
@@ -54,7 +56,7 @@
 @implementation ToolTipBaseView {
   // These are part of the magic tooltip code from WebKit's WebHTMLView:
   id __weak _trackingRectOwner;
-  raw_ptr<void, DanglingUntriaged> _trackingRectUserData;
+  raw_ptr<void> _trackingRectUserData;
   NSTrackingRectTag _lastToolTipTag;
   NSString* __strong _toolTip;
 }
@@ -67,37 +69,37 @@
 // See above for rationale.
 - (NSTrackingRectTag)addTrackingRect:(NSRect)rect
                                owner:(id)owner
-                            userData:(void *)data
+                            userData:(void*)data
                         assumeInside:(BOOL)assumeInside {
-  DCHECK(_trackingRectOwner == nil);
+  DCHECK_EQ(_trackingRectOwner, nil);
   _trackingRectOwner = owner;
   _trackingRectUserData = data;
   return kTrackingRectTag;
 }
 
-// Override of (apparently) a private NSView method(!) See above for rationale.
+// Override of a private NSView method. See above for rationale.
 - (NSTrackingRectTag)_addTrackingRect:(NSRect)rect
                                 owner:(id)owner
-                             userData:(void *)data
+                             userData:(void*)data
                          assumeInside:(BOOL)assumeInside
                        useTrackingNum:(int)tag {
   DCHECK(tag == 0 || tag == kTrackingRectTag);
-  DCHECK(_trackingRectOwner == nil);
+  DCHECK_EQ(_trackingRectOwner, nil);
   _trackingRectOwner = owner;
   _trackingRectUserData = data;
   return kTrackingRectTag;
 }
 
-// Override of (apparently) a private NSView method(!) See above for rationale.
-- (void)_addTrackingRects:(NSRect *)rects
+// Override of a private NSView method. See above for rationale.
+- (void)_addTrackingRects:(NSRect*)rects
                     owner:(id)owner
-             userDataList:(void **)userDataList
-         assumeInsideList:(BOOL *)assumeInsideList
-             trackingNums:(NSTrackingRectTag *)trackingNums
+             userDataList:(void**)userDataList
+         assumeInsideList:(BOOL*)assumeInsideList
+             trackingNums:(NSTrackingRectTag*)trackingNums
                     count:(int)count {
-  DCHECK(count == 1);
+  DCHECK_EQ(count, 1);
   DCHECK(trackingNums[0] == 0 || trackingNums[0] == kTrackingRectTag);
-  DCHECK(_trackingRectOwner == nil);
+  DCHECK_EQ(_trackingRectOwner, nil);
   _trackingRectOwner = owner;
   _trackingRectUserData = userDataList[0];
   trackingNums[0] = kTrackingRectTag;
@@ -106,11 +108,13 @@
 // Override of a public NSView method, replacing the inherited functionality.
 // See above for rationale.
 - (void)removeTrackingRect:(NSTrackingRectTag)tag {
-  if (tag == 0)
+  if (tag == 0) {
     return;
+  }
 
   if (tag == kTrackingRectTag) {
     _trackingRectOwner = nil;
+    _trackingRectUserData = nullptr;
     return;
   }
 
@@ -121,19 +125,21 @@
   }
 
   // If any other tracking rect is being removed, we don't know how it was
-  // created and it's possible there's a leak involved (see Radar 3500217).
+  // created and it's possible there's a leak involved (see rdar://3500217).
   NOTREACHED();
 }
 
-// Override of (apparently) a private NSView method(!)
-- (void)_removeTrackingRects:(NSTrackingRectTag *)tags count:(int)count {
+// Override of a private NSView method.
+- (void)_removeTrackingRects:(NSTrackingRectTag*)tags count:(int)count {
   for (int i = 0; i < count; ++i) {
     // SAFETY: count provided by caller.
     NSTrackingRectTag tag = UNSAFE_BUFFERS(tags[i]);
-    if (tag == 0)
+    if (tag == 0) {
       continue;
-    DCHECK(tag == kTrackingRectTag);
+    }
+    DCHECK_EQ(tag, kTrackingRectTag);
     _trackingRectOwner = nil;
+    _trackingRectUserData = nullptr;
   }
 }
 
@@ -160,7 +166,7 @@
   NSInteger windowNumber = self.window.windowNumber;
 
   // Only send a fake mouse enter if the mouse is actually over the window,
-  // versus over a window which overlaps it (see http://crbug.com/883269).
+  // versus over a window which overlaps it (see https://crbug.com/40092440).
   if ([NSWindow windowNumberAtPoint:NSEvent.mouseLocation
           belowWindowWithWindowNumber:0] != windowNumber) {
     return;
@@ -207,7 +213,7 @@
 // Sets the view's current tooltip, to be displayed at the current mouse
 // location. (This does not make the tooltip appear -- as usual, it only
 // appears after a delay.) Pass null to remove the tooltip.
-- (void)setToolTipAtMousePoint:(NSString *)string {
+- (void)setToolTipAtMousePoint:(NSString*)string {
   NSString* toolTip = string.length == 0 ? nil : string;
   if ((toolTip && _toolTip && [toolTip isEqualToString:_toolTip]) ||
       (!toolTip && !_toolTip)) {
@@ -229,11 +235,11 @@
   //
   // By moving the call to -removeAllTooltips outside of the conditional,
   // we can ensure any visible tooltip will be removed from the screen.
-  // See crbug.com/1409942.
+  // See https://crbug.com/40889407.
   //
   // The strategy of removing all tooltips rather than the single one that
   // was added comes from WebKit, like the rest of the code here. It
-  // apparently works around some AppKit bug.
+  // apparently works around some AppKit bug, the same rdar://3500217 as above.
   [self removeAllToolTips];
   if (toolTip) {
     NSRect wideOpenRect = NSMakeRect(-100000, -100000, 200000, 200000);
@@ -245,10 +251,10 @@
 }
 
 // NSView calls this to get the text when displaying the tooltip.
-- (NSString *)view:(NSView *)view
-  stringForToolTip:(NSToolTipTag)tag
-             point:(NSPoint)point
-          userData:(void *)data {
+- (NSString*)view:(NSView*)view
+    stringForToolTip:(NSToolTipTag)tag
+               point:(NSPoint)point
+            userData:(void*)data {
   return [_toolTip copy];
 }