M2 batch C: the five control kinds — permissions, TLS errors, HTTP auth, downloads, context menus #112
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "capture/batch-c-control-kinds"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Verified live:
tests/interactiveis 89/89 with ZERO failures on guestcr7727-eb156dd5bf6a— the first clean sweep of the full suite. Lane: 641 steps, 0 failed, 0 undefined symbols.What each kind replaces
permissiongetCurrentPosition()denied instantly, nobody asked — indistinguishable from a user saying no, which is why it went unnoticedcert_errorlogindownloadcontext_menuReading the tree first paid for itself
Every API was read from the pinned checkout before a line was written, and the roadmap was wrong about one:
CreateLoginDelegatetakes eleven parameters at 7727, including aGuestPageHolder*nobody anticipated, and it lives onContentBrowserClientrather thanWebContentsDelegate.Its real contract is in the header comment, not the (nearly empty) interface: the callback runs on the UI thread, must not be reentrant, and must not run at all once the delegate is destroyed — destruction IS the cancellation. That is why the response is bound through a WeakPtr.
Also caught before the lane:
CERTIFICATE_REQUEST_RESULT_TYPE_*lives in its own header, andnet/base/auth.his not pulled in bycontent_browser_client.h(whileGuestPageHolderandGlobalRequestIDare, as forward declarations — enough for a pointer and a const ref).One lane cycle, and the lint that now catches it
Eight
member access into incomplete type 'const content::ContextMenuParams'.web_contents_delegate.hforward-declares it at :117 — enough to NAME it in the override, not enough to read a field.--keep-goingmade it cheap: one pass proved all eight were a single root cause in a single file, so the other four new TUs were confirmed clean in the same cycle.lint-cxxgains three rules for the class, because it was clean while the compiler failed. Worth noting the first version was wrong: keyed on the type NAME, it flagged two entirely correct files — a header naming the type in a signature needs only the forward declaration. Re-keyed on member access, it is clean across 142 files and its negative control reproduces the exact finding.Two things I got wrong and corrected
certErrorTexthad three of five net error codes wrong — -200 and -202 swapped (name mismatch vs unknown authority), REVOKED/WEAK at -207/-211 instead of -206/-208. A prompt naming the wrong reason is worse than one naming none: it invites a decision on false grounds. Now read fromnet_error_list.hand pinned in a test.ALL BLOBS OKagainst zero parsed layers. That vacuous pass would have let me redeploy a truncated image. It now asserts a non-empty layer list first — 20/20 confirmed on the real push.The control channel now has a protocol spec
Seven kinds and no documentation outside a C++ header.
docs/protocols/control-channel.mdrecords the invariant that matters — every request resolves exactly once and never depends on the viewer, becauseRunJavaScriptDialogblocks the page's JS thread andRunFileChooserholds a listener chromium CHECKs on — and the rule that makes new kinds safe: every default is what the guest did before the kind existed.Infrastructure, documented where it bit
TURN's relay IP is hardcoded in
deploy.sh; coturn runshostNetworkand was rescheduled off that node, so the IP had nothing on 3478. The symptom is ECONNREFUSED and a session that negotiates and never decodes a frame — identical to an expired credential, which had also expired 26 h earlier, so fixing that was right and changed nothing.deploy.shnow carries the one-command test that separates them, and the fact that the worker keeps its ownWEBRTC_ICE_SERVERSthat patching the broker does not reach.Also corrected: my earlier claim that a 300s push deadline was too small for a 210 MB layer. The real cause was the registry's S3 backend stalling a multipart upload — a plain retry fixes it, more deadline does not.
Verification
tests/interactiveCreateLoginDelegate returned nullptr, which //content reads as "the embedder will not handle this" and cancels the challenge. A 401 therefore rendered the server's own error body, or a blank page, with no way to supply credentials — a whole class of intranet and appliance URLs simply could not be opened. The signature is the one the roadmap got wrong: ELEVEN parameters at 7727, including a GuestPageHolder* nobody anticipated, and it lives on ContentBrowserClient rather than WebContentsDelegate. Read from the tree before writing a line. The real contract is in the header comment, not the interface — LoginDelegate itself is a virtual destructor and one type alias: * the callback runs on the UI thread, * it must NOT be called reentrantly (post it if the answer is known synchronously — the no-channel path does exactly that), * DESTRUCTION IS CANCELLATION: if the delegate dies first, the callback must not run at all. That last rule is why the response is bound through a WeakPtr. The control channel can answer at any time, including after //content has dropped us, and answering then writes into torn-down request state rather than being a harmless late reply. The destructor deliberately does not run the callback, and says so. std::nullopt is a cancelled login, which //content turns back into the 401 — the default for every path that is not an explicit answer. first_attempt is forwarded because it is false on a retry, i.e. "the last credentials were rejected". Without it the second prompt looks identical to the first and the user retypes the same wrong password. is_proxy likewise: proxy credentials are a different secret, and a prompt that conflates them invites the wrong password. Include verification worth recording: `make lint-cxx` caught FROM_HERE without base/location.h here — the exact defect that lint was written for after Cb.shutdown shipped with it. And net/base/auth.h is NOT pulled in by content_browser_client.h (it includes only schemeful_site and two cookie headers from net/), while GuestPageHolder and GlobalRequestID ARE, as forward declarations at :255 and :289 — enough for a pointer and a const ref. UNVERIFIED: capture/ does not compile locally. The lane has not run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>