`LanguageDetectionModel`

the Translate component’s on-device language-identification model wrapper in language_detection_model.cc, which loads its model asynchronously and lets clients register a ModelLoadedCallback to run once loading finishes.

`model_loaded_callbacks_`

a std::vector<ModelLoadedCallback> member holding callbacks that are queued while the model is not yet loaded and are drained by NotifyModelLoaded().

Iterator invalidation

when a std::vector grows past its capacity during a range-for loop, it reallocates its backing store, so the loop’s iterator still points into the freed buffer.

Re-entrancy

a callback invoked from inside a loop can call back into the same object and change the container that the loop is still walking.

1. Model load pending While the language detection model is still loading, one or more clients register ModelLoadedCallbacks, which are queued in model_loaded_callbacks_.
2. Load completes NotifyModelLoaded() runs and walks model_loaded_callbacks_ directly, with loaded_ still false.
3. Re-entrant registration A callback’s handling causes another load-completion callback to be registered on the same model. Because loaded_ is still false, it is pushed onto model_loaded_callbacks_ (inferred: the add path is not in the diff).
4. Reallocation frees the iterated buffer If the push exceeds capacity, the vector reallocates, and the range-for iterator keeps reading moved-from ModelLoadedCallback storage in the freed buffer, which is a heap UAF.
5. Memory corruption Running a callback object read from freed, possibly reclaimed memory could redirect control flow (inferred; the patch shows only the iterator-invalidation precondition).

• components/language_detection/core/language_detection_model.cc

• Callback-list dispatch over members
  Search for for (auto&& cb : member_callbacks_) std::move(cb).Run(...) patterns where the callback can reach an Add*Callback/Register* method on the same object. Prefer swap-then-iterate, base::OnceCallbackList, or posting each callback as a task.
• State flag set after dispatch
  Look for flags like loaded_/ready_/initialized_ that are set only after notifying observers. Re-entrant calls see the stale state and take the “queue it” path, which can mutate containers or drop callbacks.
• Self-destruction during notification
  In NotifyModelLoaded() and similar code, check whether a callback can destroy the owning object. The post-loop loaded_ = true write would then touch freed this, and the swap fix does not address that case.

AddressSanitizer:heap-use-after-free on LanguageDetectionModel::NotifyModelLoaded

void LanguageDetectionModel::NotifyModelLoaded() {
  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
  for (auto&& callback_ : model_loaded_callbacks_) {
    std::move(callback_).Run(*this);
  }
  loaded_ = true;
  model_loaded_callbacks_.clear();
}
------------------------
void LanguageDetectionModel::AddOnModelLoadedCallback(
    ModelLoadedCallback callback) {
  DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
  if (loaded_ || model_loaded_callbacks_.size() >= kMaxPendingCallbacksCount) {
    std::move(callback).Run(*this);
  } else {
    model_loaded_callbacks_.emplace_back(std::move(callback));
  }
}
------------------------
void DetectLanguage(const WTF::String& text,
                    DetectLanguageCallback on_complete) {
  auto& model = language_detection::GetLanguageDetectionModel();
  model.AddOnModelLoadedCallback(
      WTF::BindOnce(DetectLanguageWithModel, text, std::move(on_complete)));
}
------------------------
ScriptPromise<IDLSequence<LanguageDetectionResult>> AILanguageDetector::detect(
    ScriptState* script_state,
    const WTF::String& input,
    AILanguageDetectorDetectOptions* options,
    ExceptionState& exception_state) {
[...]

  DetectLanguage(input, WTF::BindOnce(AILanguageDetector::OnDetectComplete,
                                      WrapPersistent(resolver)));
  return resolver->Promise();
}
-----------------------
void AILanguageDetector::OnDetectComplete(
    ScriptPromiseResolver<IDLSequence<LanguageDetectionResult>>* resolver,
    base::expected<WTF::Vector<LanguagePrediction>, DetectLanguageError>
        result) {
  if (result.has_value()) {
    // Order the result from most to least confident.
    std::sort(result.value().rbegin(), result.value().rend());
    resolver->Resolve(ConvertResult(result.value()));
  } else {
    switch (result.error()) {
      case DetectLanguageError::kUnavailable:
        resolver->Reject("Model not available");
    }
  }
}

void LanguageDetectionAgent::WasShown() {
  // Check if the the render frame was initially hidden and
  // the model request was delayed until the frame was in
  // the foreground.
[...]
  GetLanguageDetectionHandler()->GetLanguageDetectionModel(
      base::BindOnce(&LanguageDetectionAgent::UpdateLanguageDetectionModel,
                     weak_pointer_factory_.GetWeakPtr()));
}