From 4492ca1c2c11ea98174d0433c699adb8d2040b32 Mon Sep 17 00:00:00 2001
From: Avi Drissman <avi@chromium.org>
Date: Tue, 05 May 2026 15:24:05 -0700
Subject: [PATCH] Do pasteboard observation on the main thread

When tracking pasteboard changes, the implementation overrides internal
pasteboard implementation methods that get called on random internal
AppKit threads. Be sure to do all Chromium processing back on the main
thread, as the code called isn't necessarily thread-safe.

Fixed: 508456788
Link: https://chromium-review.googlesource.com/id/I3e494418430189cc821f1c14fd1cfa466a6a6964
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7806661
Reviewed-by: Mark Mentovai <mark@chromium.org>
Commit-Queue: Avi Drissman <avi@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1625756}
---

diff --git a/base/mac/pasteboard_changed_observation.h b/base/mac/pasteboard_changed_observation.h
index bea89ba..2d80ef5 100644
--- a/base/mac/pasteboard_changed_observation.h
+++ b/base/mac/pasteboard_changed_observation.h
@@ -14,6 +14,9 @@
 // Registers a callback that will be called whenever the
 // NSPasteboard.generalPasteboard has been changed by any process on the system
 // (including this one).
+//
+// This registration call must be made on the main thread, and the callback will
+// be done on the main thread.
 BASE_EXPORT CallbackListSubscription
 RegisterPasteboardChangedCallback(RepeatingClosure callback);
 
diff --git a/base/mac/pasteboard_changed_observation.mm b/base/mac/pasteboard_changed_observation.mm
index 04c0d35..9868a87 100644
--- a/base/mac/pasteboard_changed_observation.mm
+++ b/base/mac/pasteboard_changed_observation.mm
@@ -11,10 +11,11 @@
 #include <string_view>
 
 #include "base/callback_list.h"
+#include "base/functional/bind.h"
 #include "base/functional/callback.h"
+#include "base/location.h"
 #include "base/no_destructor.h"
-#include "base/task/bind_post_task.h"
-#include "base/task/sequenced_task_runner.h"
+#include "base/task/single_thread_task_runner.h"
 
 // There is no notification API on macOS for changes to the pasteboard (unlike
 // on iOS where there is UIPasteboardChangedNotification). However...
@@ -77,15 +78,17 @@
 
   IMP new_imp =
       imp_implementationWithBlock(^(id object_self, int change_count) {
-        GetCallbackList().Notify();
+        // Hop to the main thread, as the cache is processed on an internal
+        // CFPasteboard dispatch queue.
+        base::SingleThreadTaskRunner::GetMainThreadDefault()->PostTask(
+            FROM_HERE, base::BindOnce([] {
+              GetCallbackList().Notify();
 
-        // Dirty the app's pasteboard cache to ensure an invalidation callback
-        // for the next pasteboard change that occurs in other apps. Hop to the
-        // main thread, as the cache is processed on an internal CFPasteboard
-        // dispatch queue.
-        dispatch_async(dispatch_get_main_queue(), ^{
-          std::ignore = NSPasteboard.generalPasteboard.changeCount;
-        });
+              // Dirty the app's pasteboard cache to ensure an invalidation
+              // callback for the next pasteboard change that occurs in other
+              // apps.
+              std::ignore = NSPasteboard.generalPasteboard.changeCount;
+            }));
 
         g_old_imp(object_self, selector, change_count);
       });
@@ -100,6 +103,9 @@
 
 CallbackListSubscription RegisterPasteboardChangedCallback(
     RepeatingClosure callback) {
+  CHECK(base::SingleThreadTaskRunner::GetMainThreadDefault()
+            ->BelongsToCurrentThread());
+
   static bool swizzle_internal_class [[maybe_unused]] = SwizzleInternalClass();
   // Intentionally DCHECK so that in the field it doesn't rely on that specific
   // internal class (as listening for pasteboard changes isn't critical), but
@@ -107,8 +113,7 @@
   // ever change it will be noticed.
   DCHECK(swizzle_internal_class);
 
-  return GetCallbackList().Add(
-      base::BindPostTask(SequencedTaskRunner::GetCurrentDefault(), callback));
+  return GetCallbackList().Add(callback);
 }
 
 }  // namespace base