From 5a68bc6c97d97312ffa0f9ac04e2288f1cdadd13 Mon Sep 17 00:00:00 2001
From: Maks Orlovich <morlovich@chromium.org>
Date: Fri, 26 Jun 2026 15:18:17 -0700
Subject: [PATCH] FLEDGE: fix lifetime reportWin's deprecatedUrl handler.

Other lazy fillers seem fine on read-through, but just in case:
1) Reuse unused logger param from the config filler --- it gets
   it from ContextRecycler, and using the passed in one would
   cause trouble.
2) Call the checkpoint after resetting the bindings and lazy fillers.

Bug: 527406824
Change-Id: I570a1267be21d9d398c4e2102e21a6bb923345c2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8006698
Reviewed-by: mmenke <mmenke@chromium.org>
Commit-Queue: Maks Orlovich <morlovich@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1653488}
---

diff --git a/content/services/auction_worklet/bidder_worklet.cc b/content/services/auction_worklet/bidder_worklet.cc
index 53a0ce1eb..489e1fc 100644
--- a/content/services/auction_worklet/bidder_worklet.cc
+++ b/content/services/auction_worklet/bidder_worklet.cc
@@ -1128,6 +1128,12 @@
   AuctionV8Helper::FullIsolateScope isolate_scope(v8_helper_.get());
   v8::Isolate* isolate = v8_helper_->isolate();
 
+  // Needs to outlast ContextRecyclerScope. See crbug.com/527406824.
+  DeprecatedUrlLazyFiller deprecated_render_url(
+      v8_helper_.get(), &browser_signal_render_url,
+      "browserSignals.renderUrl is deprecated."
+      " Please use browserSignals.renderURL instead.");
+
   // Short lived context, to avoid leaking data at global scope between either
   // repeated calls to this worklet, or to calls to any other worklet.
   ContextRecycler context_recycler(v8_helper_.get());
@@ -1176,10 +1182,6 @@
 
   context_recycler.AddReportWinBrowserSignalsLazyFiller();
 
-  DeprecatedUrlLazyFiller deprecated_render_url(
-      v8_helper_.get(), &v8_logger, &browser_signal_render_url,
-      "browserSignals.renderUrl is deprecated."
-      " Please use browserSignals.renderURL instead.");
   base::TimeDelta reporting_timeout =
       browser_signal_reporting_timeout.has_value()
           ? *browser_signal_reporting_timeout
@@ -1238,6 +1240,8 @@
   }
   args.push_back(direct_from_seller_signals);
 
+  deprecated_render_url.SetLogger(&v8_logger);
+
   // An empty return value indicates an exception was thrown. Any other return
   // value indicates no exception.
   v8_helper_->MaybeTriggerInstrumentationBreakpoint(
@@ -1253,6 +1257,7 @@
       v8_helper_->RunScript(context, unbound_worklet_script, debug_id_.get(),
                             total_timeout.get(), errors_out);
   if (result != AuctionV8Helper::Result::kSuccess) {
+    deprecated_render_url.SetLogger(nullptr);
     TRACE_EVENT_END("fledge", perfetto::Track(trace_id));
     PostReportWinCallbackToUserThread(
         std::move(callback), /*report_url=*/std::nullopt,
@@ -1293,6 +1298,7 @@
   base::UmaHistogramTimes("Ads.InterestGroup.Auction.ReportWinTime", elapsed);
 
   if (result != AuctionV8Helper::Result::kSuccess) {
+    deprecated_render_url.SetLogger(nullptr);
     // Keep Private Aggregation API requests since `reportWin()` might use it to
     // detect script timeout or failures.
     PostReportWinCallbackToUserThread(
@@ -1399,6 +1405,7 @@
   }
   // This covers both the case where a report URL was provided, and the case one
   // was not.
+  deprecated_render_url.SetLogger(nullptr);
   PostReportWinCallbackToUserThread(
       std::move(callback), context_recycler.report_bindings()->report_url(),
       context_recycler.register_ad_beacon_bindings()->TakeAdBeaconMap(),
diff --git a/content/services/auction_worklet/bidder_worklet_unittest.cc b/content/services/auction_worklet/bidder_worklet_unittest.cc
index 5805ba89..a6542e1 100644
--- a/content/services/auction_worklet/bidder_worklet_unittest.cc
+++ b/content/services/auction_worklet/bidder_worklet_unittest.cc
@@ -8712,6 +8712,33 @@
   channel->ExpectNoMoreConsoleEvents();
 }
 
+TEST_F(BidderWorkletTest, ReportWinBrowserSignalRenderUrlDeprecationAsync) {
+  // From https://crbug.com/527406824
+  const char kBody[] = R"(
+      globalThis.savedBrowserSignals = browserSignals;
+      Promise.resolve().then(() => {
+        void globalThis.savedBrowserSignals.renderUrl;
+      });
+
+      // Force reportWin timeout. V8's normal auto microtask checkpoint is
+      // skipped while execution is terminating; AuctionWorklet's
+      // ContextRecyclerScope then performs a later ResetForReuse() microtask
+      // checkpoint after stack unwind.
+      while (true) {}
+  )";
+  AddJavascriptResponse(&url_loader_factory_, interest_group_bidding_url_,
+                        CreateReportWinScript(kBody));
+  RunReportWinExpectingResult(
+      /*expected_report_url=*/std::nullopt,
+      /*expected_ad_beacon_map=*/{},
+      /*expected_ad_macro_map=*/{},
+      /*expected_pa_requests=*/{},
+      /*expected_pmt_request_data=*/nullptr,
+      /*expected_reporting_latency_timeout=*/true,
+      /*expected_errors=*/
+      {"https://url.test/ execution of `reportWin` timed out."});
+}
+
 // Check that accessing `renderURL` of browserSignals does not display a
 // warning.
 //
diff --git a/content/services/auction_worklet/context_recycler.cc b/content/services/auction_worklet/context_recycler.cc
index 4036d8cf7..38e26c5 100644
--- a/content/services/auction_worklet/context_recycler.cc
+++ b/content/services/auction_worklet/context_recycler.cc
@@ -183,12 +183,6 @@
 }
 
 void ContextRecycler::ResetForReuse() {
-  // Make sure that microtasks get flushed as they would not on timeout.
-  {
-    AuctionV8Helper::TimeLimitScope time_scope(v8_helper_->GetTimeLimit());
-    v8_helper_->isolate()->PerformMicrotaskCheckpoint();
-  }
-
   for (Bindings* bindings : bindings_list_) {
     bindings->Reset();
   }
@@ -207,6 +201,12 @@
   for (const auto& auction_config_lazy_filler : auction_config_lazy_fillers_) {
     auction_config_lazy_filler->Reset();
   }
+
+  // Make sure that microtasks get flushed as they would not on timeout.
+  {
+    AuctionV8Helper::TimeLimitScope time_scope(v8_helper_->GetTimeLimit());
+    v8_helper_->isolate()->PerformMicrotaskCheckpoint();
+  }
 }
 
 ContextRecyclerScope::ContextRecyclerScope(ContextRecycler& context_recycler)
diff --git a/content/services/auction_worklet/deprecated_url_lazy_filler.cc b/content/services/auction_worklet/deprecated_url_lazy_filler.cc
index 22c65d0f..9dd7302b 100644
--- a/content/services/auction_worklet/deprecated_url_lazy_filler.cc
+++ b/content/services/auction_worklet/deprecated_url_lazy_filler.cc
@@ -6,6 +6,7 @@
 
 #include <string_view>
 
+#include "base/check.h"
 #include "base/memory/raw_ptr.h"
 #include "content/services/auction_worklet/auction_v8_helper.h"
 #include "content/services/auction_worklet/auction_v8_logger.h"
@@ -17,15 +18,16 @@
 namespace auction_worklet {
 
 DeprecatedUrlLazyFiller::DeprecatedUrlLazyFiller(AuctionV8Helper* v8_helper,
-                                                 AuctionV8Logger* v8_logger,
                                                  const GURL* url,
                                                  const char* warning)
     : LazyFiller(v8_helper, kTag),
-      v8_logger_(v8_logger),
+      v8_logger_(nullptr),
       url_(url),
       warning_(warning) {}
 
-DeprecatedUrlLazyFiller::~DeprecatedUrlLazyFiller() = default;
+DeprecatedUrlLazyFiller::~DeprecatedUrlLazyFiller() {
+  DCHECK_EQ(v8_logger_, nullptr);
+}
 
 bool DeprecatedUrlLazyFiller::AddDeprecatedUrlGetter(
     v8::Local<v8::Object> object,
@@ -39,7 +41,9 @@
     v8::Local<v8::Name> name,
     const v8::PropertyCallbackInfo<v8::Value>& info) {
   DeprecatedUrlLazyFiller* self = GetSelf<DeprecatedUrlLazyFiller>(info);
-  self->v8_logger_->LogConsoleWarning(self->warning_.get());
+  if (self->v8_logger_) {
+    self->v8_logger_->LogConsoleWarning(self->warning_.get());
+  }
 
   AuctionV8Helper* v8_helper = self->v8_helper();
   v8::Isolate* isolate = v8_helper->isolate();
diff --git a/content/services/auction_worklet/deprecated_url_lazy_filler.h b/content/services/auction_worklet/deprecated_url_lazy_filler.h
index 0a23197e..eaf9a82 100644
--- a/content/services/auction_worklet/deprecated_url_lazy_filler.h
+++ b/content/services/auction_worklet/deprecated_url_lazy_filler.h
@@ -34,12 +34,14 @@
   // DeprecatedUrlLazyFiller. Additionally, `url` and `warning` must not be
   // modified until the DeprecatedUrlLazyFiller is destroyed.
   DeprecatedUrlLazyFiller(AuctionV8Helper* v8_helper,
-                          AuctionV8Logger* v8_logger,

diff --git a/content/services/auction_worklet/bidder_worklet_unittest.cc b/content/services/auction_worklet/bidder_worklet_unittest.cc
index 5805ba89..a6542e1 100644
--- a/content/services/auction_worklet/bidder_worklet_unittest.cc
+++ b/content/services/auction_worklet/bidder_worklet_unittest.cc
@@ -8712,6 +8712,33 @@
   channel->ExpectNoMoreConsoleEvents();
 }
 
+TEST_F(BidderWorkletTest, ReportWinBrowserSignalRenderUrlDeprecationAsync) {
+  // From https://crbug.com/527406824
+  const char kBody[] = R"(
+      globalThis.savedBrowserSignals = browserSignals;
+      Promise.resolve().then(() => {
+        void globalThis.savedBrowserSignals.renderUrl;
+      });
+
+      // Force reportWin timeout. V8's normal auto microtask checkpoint is
+      // skipped while execution is terminating; AuctionWorklet's
+      // ContextRecyclerScope then performs a later ResetForReuse() microtask
+      // checkpoint after stack unwind.
+      while (true) {}
+  )";
+  AddJavascriptResponse(&url_loader_factory_, interest_group_bidding_url_,
+                        CreateReportWinScript(kBody));
+  RunReportWinExpectingResult(
+      /*expected_report_url=*/std::nullopt,
+      /*expected_ad_beacon_map=*/{},
+      /*expected_ad_macro_map=*/{},
+      /*expected_pa_requests=*/{},
+      /*expected_pmt_request_data=*/nullptr,
+      /*expected_reporting_latency_timeout=*/true,
+      /*expected_errors=*/
+      {"https://url.test/ execution of `reportWin` timed out."});
+}
+
 // Check that accessing `renderURL` of browserSignals does not display a
 // warning.
 //