Annotate Cross task dangling pointers detected on Linux builds

This adds the DanglingAcrossTasks keyword and annotates raw_ptrs that
are "dangling cross task", i.e. that are freed and released in
different tasks.
These are more likely to allow UAFs and therefore are prioritized
over other dangling raw_ptr (Those remaining with DanglingUntriaged).

Protocol used:
1. Apply automatic dangling pointer annotation: crrev.com/c/4474553
2. Disable "DanglingUntriaged":
``` base/allocator/partition_allocator/pointers/raw_ptr.h:
constexpr auto DanglingUntriaged = base::RawPtrTraits::kEmpty ```
3. Configure Dangling pointer detection for cross tasks detection and logging only.
4. Run all tests using https://docs.google.com/document/d/1AMMERcqy0eafFWopUCHYsIKIKEp3J8DFxqW9UIbzIHo/edit?pli=1&resourcekey=0-e12-tlqsWfAOkle97uWw3w
5. Concatenate and filter output:
``` cat output_* | sort -nr | uniq | sed -e 's/\(.\)Found/\1\nFound/g' | grep -a -e "../../" | sed 's_^.*\.\./\.\./__' | sort | uniq > test_output_all
6. Apply the annotation using https://docs.google.com/document/d/1SGMZAaoEb6J0-NQO5V07TShxGAL5bxVN08TylBOrSCw/edit?usp=sharing

Change-Id: If176e8f7269ec4a95976e351e9b35a5cb8e4c699
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4567353
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: danakj <danakj@chromium.org>
Auto-Submit: Pâris Meuleman <pmeuleman@chromium.org>
Reviewed-by: Bartek Nowierski <bartekn@chromium.org>
Commit-Queue: Pâris Meuleman <pmeuleman@chromium.org>
Owners-Override: danakj <danakj@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1162824}

base/allocator/partition_allocator/pointers/raw_ptr.h

@@ -1176,6 +1176,12 @@ constexpr auto DanglingUntriaged = base::RawPtrTraits::kMayDangle;
 // This is not meant to be added manually. You can ignore this flag.
 constexpr auto FlakyDanglingUntriaged = base::RawPtrTraits::kMayDangle;
 
+// Dangling raw_ptr that is more likely to cause UAF: its memory was freed in
+// one task, and the raw_ptr was released in a different one.
+//
+// This is not meant to be added manually. You can ignore this flag.
+constexpr auto DanglingAcrossTasks = base::RawPtrTraits::kMayDangle;
+
 // The use of pointer arithmetic with raw_ptr is strongly discouraged and
 // disabled by default. Usually a container like span<> should be used
 // instead of the raw_ptr.

base/files/file_descriptor_watcher_posix.h

@@ -76,7 +76,7 @@ class BASE_EXPORT FileDescriptorWatcher {
     // Controller is deleted, ownership of |watcher_| is transfered to a delete
     // task posted to the MessageLoopForIO. This ensures that |watcher_| isn't
     // deleted while it is being used by the MessageLoopForIO.
-    raw_ptr<Watcher, DanglingUntriaged> watcher_;
+    raw_ptr<Watcher, DanglingAcrossTasks> watcher_;
 
     // An event for the watcher to notify controller that it's destroyed.
     // As the |watcher_| is owned by Controller, always outlives the Watcher.

base/message_loop/message_pump_libevent.h

@@ -93,7 +93,7 @@ class BASE_EXPORT MessagePumpLibevent : public MessagePump,
     friend class RefCounted<EpollInterest>;
     ~EpollInterest();
 
-    const raw_ptr<FdWatchController, DanglingUntriaged> controller_;
+    const raw_ptr<FdWatchController, DanglingAcrossTasks> controller_;
     const EpollInterestParams params_;
     bool active_ = true;
     bool was_controller_destroyed_ = false;

base/observer_list_internal.h

@@ -54,7 +54,7 @@ class BASE_EXPORT UncheckedObserverAdapter {
 #endif  // DCHECK_IS_ON()
 
  private:
-  raw_ptr<void, DanglingUntriaged> ptr_;
+  raw_ptr<void, DanglingAcrossTasks> ptr_;
 #if DCHECK_IS_ON()
   base::debug::StackTrace stack_;
 #endif  // DCHECK_IS_ON()

base/synchronization/waitable_event_watcher.h

@@ -144,7 +144,7 @@ class BASE_EXPORT WaitableEventWatcher
   scoped_refptr<Flag> cancel_flag_;
 
   // Enqueued in the wait list of the watched WaitableEvent.
-  raw_ptr<AsyncWaiter, DanglingUntriaged> waiter_ = nullptr;
+  raw_ptr<AsyncWaiter, DanglingAcrossTasks> waiter_ = nullptr;
 
   // Kernel of the watched WaitableEvent.
   scoped_refptr<WaitableEvent::WaitableEventKernel> kernel_;

base/threading/sequence_bound_internal.h

@@ -150,7 +150,7 @@ class Storage {
   // Storage originally allocated by `AlignedAlloc()`. Maintained separately
   // from  `ptr_` since the original, unadjusted pointer needs to be passed to
   // `AlignedFree()`.
-  raw_ptr<void, DanglingUntriaged> alloc_ = nullptr;
+  raw_ptr<void, DanglingAcrossTasks> alloc_ = nullptr;
 };
 
 template <typename T, typename CrossThreadTraits>

cc/raster/task.h

@@ -138,8 +138,8 @@ struct CC_EXPORT TaskGraph {
     Edge(const Task* task, Task* dependent)
         : task(task), dependent(dependent) {}
 
-    raw_ptr<const Task, DanglingUntriaged> task;
-    raw_ptr<Task, DanglingUntriaged> dependent;
+    raw_ptr<const Task, DanglingAcrossTasks> task;
+    raw_ptr<Task, DanglingAcrossTasks> dependent;
   };
 
   TaskGraph();

cc/scheduler/scheduler.h

@@ -296,7 +296,7 @@ class CC_EXPORT Scheduler : public viz::BeginFrameObserverBase {
 
   // Owned by LayerTreeHostImpl and is destroyed when LayerTreeHostImpl is
   // destroyed.
-  raw_ptr<CompositorFrameReportingController, DanglingUntriaged>
+  raw_ptr<CompositorFrameReportingController, DanglingAcrossTasks>
       compositor_frame_reporting_controller_;
 
   // What the latest deadline was, and when it was scheduled.

cc/tiles/tile_manager.cc

@@ -179,7 +179,7 @@ class RasterTaskImpl : public TileTask {
   TileResolution tile_resolution_;
   int layer_id_;
   uint64_t source_prepare_tiles_id_;
-  raw_ptr<void, DanglingUntriaged> tile_tracing_id_;
+  raw_ptr<void, DanglingAcrossTasks> tile_tracing_id_;
   uint64_t new_content_id_;
   int source_frame_number_;
   std::unique_ptr<RasterBuffer> raster_buffer_;

chrome/browser/background/background_mode_manager.h

@@ -413,7 +413,7 @@ class BackgroundModeManager : public BrowserListObserver,
 
   // Reference to the ProfileAttributesStorage. It is used to update the
   // background app status of profiles when they open/close background apps.
-  raw_ptr<ProfileAttributesStorage, DanglingUntriaged> profile_storage_;
+  raw_ptr<ProfileAttributesStorage, DanglingAcrossTasks> profile_storage_;
 
   // Registrars for managing our change observers.
   base::CallbackListSubscription on_app_terminating_subscription_;

chrome/browser/browser_process_impl.h

@@ -269,7 +269,7 @@ class BrowserProcessImpl : public BrowserProcess,
   const std::unique_ptr<PrefService> local_state_;
 
   // |metrics_services_manager_| owns this.
-  raw_ptr<ChromeMetricsServicesManagerClient, DanglingUntriaged>
+  raw_ptr<ChromeMetricsServicesManagerClient, DanglingAcrossTasks>
       metrics_services_manager_client_ = nullptr;
 
   // Must be destroyed before |local_state_|.

chrome/browser/chrome_browser_field_trials.h

@@ -37,7 +37,7 @@ class ChromeBrowserFieldTrials : public variations::PlatformFieldTrials {
 
  private:
   // Weak pointer to the local state prefs store.
-  const raw_ptr<PrefService, DanglingUntriaged> local_state_;
+  const raw_ptr<PrefService, DanglingAcrossTasks> local_state_;
 
 #if BUILDFLAG(IS_ANDROID)
   // VariationID to be used for FREMobileIdentityConsistencyFieldTrial.

chrome/browser/chrome_multiprofile_startup_browsertest.cc

@@ -159,7 +159,7 @@ class ChromeMultiProfileStartupBrowserTestBase
     }
   }
 
-  raw_ptr<MockMainExtraParts, DanglingUntriaged> mock_part_;
+  raw_ptr<MockMainExtraParts, DanglingAcrossTasks> mock_part_;
 };
 
 IN_PROC_BROWSER_TEST_P(ChromeMultiProfileStartupBrowserTestBase,

chrome/browser/commerce/coupons/coupon_db.h

@@ -59,7 +59,7 @@ class CouponDB {
   void OnOperationFinished(bool success);
 
  private:
-  raw_ptr<SessionProtoDB<coupon_db::CouponContentProto>, DanglingUntriaged>
+  raw_ptr<SessionProtoDB<coupon_db::CouponContentProto>, DanglingAcrossTasks>
       proto_db_;
   base::WeakPtrFactory<CouponDB> weak_ptr_factory_{this};
 };

chrome/browser/download/bubble/download_bubble_ui_controller.h

@@ -125,7 +125,7 @@ class DownloadBubbleUIController {
   // DownloadDisplayController and DownloadBubbleUIController have the same
   // lifetime. Both are owned, constructed together, and destructed together by
   // DownloadToolbarButtonView. If one is valid, so is the other.
-  raw_ptr<DownloadDisplayController, DanglingUntriaged> display_controller_;
+  raw_ptr<DownloadDisplayController, DanglingAcrossTasks> display_controller_;
 
   absl::optional<base::Time> last_partial_view_shown_time_ = absl::nullopt;
 

chrome/browser/enterprise/connectors/reporting/extension_install_event_router.h

@@ -38,7 +38,7 @@ class ExtensionInstallEventRouter
   void StartObserving();
 
  private:
-  raw_ptr<RealtimeReportingClient, DanglingUntriaged> reporting_client_ =
+  raw_ptr<RealtimeReportingClient, DanglingAcrossTasks> reporting_client_ =
       nullptr;
   raw_ptr<extensions::ExtensionRegistry, DanglingUntriaged>
       extension_registry_ = nullptr;

chrome/browser/enterprise/idle/idle_service_interactive_uitest.cc

@@ -218,7 +218,7 @@ class IdleServiceTest : public InProcessBrowserTest {
  private:
   testing::NiceMock<policy::MockConfigurationPolicyProvider>
       policy_providers_[2];
-  raw_ptr<MockIdleTimeProvider, DanglingUntriaged> idle_time_provider_;
+  raw_ptr<MockIdleTimeProvider, DanglingAcrossTasks> idle_time_provider_;
   scoped_refptr<base::TestMockTimeTaskRunner> task_runner_;
   std::unique_ptr<ui::test::ScopedIdleProviderForTest> scoped_idle_provider_;
   std::unique_ptr<ScopedKeepAlive> keep_alive_;

chrome/browser/extensions/chrome_app_sorting.h

@@ -184,9 +184,9 @@ class ChromeAppSorting : public AppSorting,
 
   const raw_ptr<content::BrowserContext, DanglingUntriaged> browser_context_ =
       nullptr;
-  raw_ptr<const web_app::WebAppRegistrar, DanglingUntriaged>
+  raw_ptr<const web_app::WebAppRegistrar, DanglingAcrossTasks>
       web_app_registrar_ = nullptr;
-  raw_ptr<web_app::WebAppSyncBridge, DanglingUntriaged> web_app_sync_bridge_ =
+  raw_ptr<web_app::WebAppSyncBridge, DanglingAcrossTasks> web_app_sync_bridge_ =
       nullptr;
   base::ScopedObservation<web_app::WebAppRegistrar,
                           web_app::WebAppRegistrarObserver>

chrome/browser/extensions/chrome_content_verifier_delegate.h

@@ -92,7 +92,7 @@ class ChromeContentVerifierDelegate : public ContentVerifierDelegate {
   // Returns information needed for content verification of |extension|.
   VerifyInfo GetVerifyInfo(const Extension& extension) const;
 
-  raw_ptr<content::BrowserContext, DanglingUntriaged> context_;
+  raw_ptr<content::BrowserContext, DanglingAcrossTasks> context_;
   VerifyInfo::Mode default_mode_;
 
   // This maps an extension id to a backoff entry for slowing down

chrome/browser/extensions/component_loader.h

@@ -227,7 +227,7 @@ class ComponentLoader {
 
   raw_ptr<Profile> profile_;
 
-  raw_ptr<ExtensionSystem, DanglingUntriaged> extension_system_;
+  raw_ptr<ExtensionSystem, DanglingAcrossTasks> extension_system_;
 
   // List of registered component extensions (see mojom::ManifestLocation).
   typedef std::vector<ComponentExtensionInfo> RegisteredComponentExtensions;

chrome/browser/extensions/extension_service.h

@@ -658,7 +658,7 @@ class ExtensionService : public ExtensionServiceInterface,
   raw_ptr<Profile> profile_ = nullptr;
 
   // The ExtensionSystem for the profile above.
-  raw_ptr<ExtensionSystem, DanglingUntriaged> system_ = nullptr;
+  raw_ptr<ExtensionSystem, DanglingAcrossTasks> system_ = nullptr;
 
   // Preferences for the owning profile.
   raw_ptr<ExtensionPrefs, DanglingUntriaged> extension_prefs_ = nullptr;

chrome/browser/font_family_cache.h

@@ -83,7 +83,7 @@ class FontFamilyCache : public base::SupportsUserData::Data {
   // Weak reference.
   // Note: The lifetime of this object is tied to the lifetime of the
   // PrefService, so there is no worry about an invalid pointer.
-  raw_ptr<const PrefService, DanglingUntriaged> prefs_;
+  raw_ptr<const PrefService, DanglingAcrossTasks> prefs_;
 
   // Reacts to profile font changes. |font_change_registrar_| will be
   // automatically unregistered when the FontPrefChangeNotifier is destroyed as

chrome/browser/metrics/chrome_feature_list_creator.h

@@ -120,7 +120,7 @@ class ChromeFeatureListCreator {
   std::string actual_locale_;
 
   // This is owned by |metrics_services_manager_| but we need to expose it.
-  raw_ptr<ChromeMetricsServicesManagerClient, DanglingUntriaged>
+  raw_ptr<ChromeMetricsServicesManagerClient, DanglingAcrossTasks>
       metrics_services_manager_client_;
 
   std::unique_ptr<metrics_services_manager::MetricsServicesManager>

chrome/browser/password_manager/chrome_password_manager_client.h

@@ -400,7 +400,7 @@ class ChromePasswordManagerClient
 #endif  // BUILDFLAG(IS_ANDROID)
 
   raw_ptr<password_manager::ContentPasswordManagerDriverFactory,
-          DanglingUntriaged>
+          DanglingAcrossTasks>
       driver_factory_;
 
   // As a mojo service, will be registered into service registry

chrome/browser/policy/cloud/cloud_policy_invalidator.h

@@ -201,7 +201,7 @@ class CloudPolicyInvalidator : public invalidation::InvalidationHandler,
   raw_ptr<base::Clock> clock_;
 
   // The invalidation service.
-  raw_ptr<invalidation::InvalidationService, DanglingUntriaged>
+  raw_ptr<invalidation::InvalidationService, DanglingAcrossTasks>
       invalidation_service_;
 
   // Whether the invalidator currently has the ability to receive invalidations.

chrome/browser/profiles/profile_key.h

@@ -49,7 +49,7 @@ class ProfileKey : public SimpleFactoryKey {
 
  private:
   raw_ptr<PrefService> prefs_ = nullptr;
-  raw_ptr<leveldb_proto::ProtoDatabaseProvider, DanglingUntriaged>
+  raw_ptr<leveldb_proto::ProtoDatabaseProvider, DanglingAcrossTasks>
       db_provider_ = nullptr;
 
   // Points to the original (non off-the-record) ProfileKey.

chrome/browser/safe_browsing/safe_browsing_service_browsertest.cc

@@ -606,12 +606,12 @@ class V4SafeBrowsingServiceTest : public InProcessBrowserTest {
  private:
   std::unique_ptr<TestSafeBrowsingServiceFactory> sb_factory_;
   // Owned by the V4Database.
-  raw_ptr<TestV4DatabaseFactory, DanglingUntriaged> v4_db_factory_;
+  raw_ptr<TestV4DatabaseFactory, DanglingAcrossTasks> v4_db_factory_;
   // Owned by the V4GetHashProtocolManager.
-  raw_ptr<TestV4GetHashProtocolManagerFactory, DanglingUntriaged>
+  raw_ptr<TestV4GetHashProtocolManagerFactory, DanglingAcrossTasks>
       v4_get_hash_factory_;
   // Owned by the V4Database.
-  raw_ptr<TestV4StoreFactory, DanglingUntriaged> store_factory_;
+  raw_ptr<TestV4StoreFactory, DanglingAcrossTasks> store_factory_;
 
 #if defined(ADDRESS_SANITIZER)
   // TODO(lukasza): https://crbug.com/971820: Disallow renderer crashes once the

chrome/browser/safe_browsing/test_safe_browsing_database_helper.h

@@ -65,11 +65,13 @@ class TestSafeBrowsingDatabaseHelper {
  private:
   std::unique_ptr<safe_browsing::TestSafeBrowsingServiceFactory> sb_factory_;
   // Owned by the V4Database.
-  raw_ptr<InsertingDatabaseFactory, DanglingUntriaged> v4_db_factory_ = nullptr;
+  raw_ptr<InsertingDatabaseFactory, DanglingAcrossTasks> v4_db_factory_ =
+      nullptr;
 
   // Owned by the V4GetHashProtocolManager. Will stay nullptr if the v4 hash
   // factory is not being mocked.
-  raw_ptr<safe_browsing::TestV4GetHashProtocolManagerFactory, DanglingUntriaged>
+  raw_ptr<safe_browsing::TestV4GetHashProtocolManagerFactory,
+          DanglingAcrossTasks>
       v4_get_hash_factory_ = nullptr;
 };
 

chrome/browser/safe_browsing/v4_embedded_test_server_browsertest.cc

@@ -120,7 +120,7 @@ class V4EmbeddedTestServerBrowserTest : public InProcessBrowserTest {
   std::unique_ptr<net::MappedHostResolver> mapped_host_resolver_;
 
   // Owned by the V4Database.
-  raw_ptr<TestV4DatabaseFactory, DanglingUntriaged> v4_db_factory_ = nullptr;
+  raw_ptr<TestV4DatabaseFactory, DanglingAcrossTasks> v4_db_factory_ = nullptr;
 };
 
 IN_PROC_BROWSER_TEST_F(V4EmbeddedTestServerBrowserTest, SimpleTest) {

chrome/browser/sharing/sharing_fcm_handler.h

@@ -101,7 +101,7 @@ class SharingFCMHandler : public gcm::GCMAppHandler {
       absl::optional<std::string> message_id,
       SharingChannelType channel_type);
 
-  const raw_ptr<gcm::GCMDriver, DanglingUntriaged> gcm_driver_;
+  const raw_ptr<gcm::GCMDriver, DanglingAcrossTasks> gcm_driver_;
   raw_ptr<syncer::DeviceInfoTracker, DanglingUntriaged> device_info_tracker_;
   raw_ptr<SharingFCMSender, DanglingUntriaged> sharing_fcm_sender_;
   raw_ptr<SharingHandlerRegistry, DanglingUntriaged> handler_registry_;

chrome/browser/sharing/sharing_fcm_sender.h

@@ -142,7 +142,7 @@ class SharingFCMSender : public SharingMessageSender::SendMessageDelegate {
   raw_ptr<SharingMessageBridge, DanglingUntriaged> sharing_message_bridge_;
   raw_ptr<SharingSyncPreference, DanglingUntriaged> sync_preference_;
   raw_ptr<VapidKeyManager, DanglingUntriaged> vapid_key_manager_;
-  raw_ptr<gcm::GCMDriver, DanglingUntriaged> gcm_driver_;
+  raw_ptr<gcm::GCMDriver, DanglingAcrossTasks> gcm_driver_;
   raw_ptr<syncer::LocalDeviceInfoProvider, DanglingUntriaged>
       local_device_info_provider_;
   raw_ptr<syncer::SyncService, DanglingUntriaged> sync_service_;

chrome/browser/subresource_filter/subresource_filter_history_observer.h

@@ -47,7 +47,7 @@ class SubresourceFilterHistoryObserver
 
   // Outlives this object.
   raw_ptr<subresource_filter::SubresourceFilterContentSettingsManager,
-          DanglingUntriaged>
+          DanglingAcrossTasks>
       settings_manager_;
 };
 

chrome/browser/sync/sessions/sync_sessions_router_tab_helper.h

@@ -78,9 +78,9 @@ class SyncSessionsRouterTabHelper
   // |router_| is a KeyedService and is guaranteed to outlive |this|.
   raw_ptr<SyncSessionsWebContentsRouter, DanglingUntriaged> router_;
 
-  raw_ptr<ChromeTranslateClient, DanglingUntriaged> chrome_translate_client_;
+  raw_ptr<ChromeTranslateClient, DanglingAcrossTasks> chrome_translate_client_;
 
-  raw_ptr<favicon::FaviconDriver, DanglingUntriaged> favicon_driver_;
+  raw_ptr<favicon::FaviconDriver, DanglingAcrossTasks> favicon_driver_;
 
   WEB_CONTENTS_USER_DATA_KEY_DECL();
 };

chrome/browser/sync_file_system/local/sync_file_system_backend.h

@@ -95,7 +95,7 @@ class SyncFileSystemBackend : public storage::FileSystemBackend {
 
   // |profile_| will initially be valid but may be destroyed before |this|, so
   // it should be checked before being accessed.
-  raw_ptr<Profile, DanglingUntriaged> profile_;
+  raw_ptr<Profile, DanglingAcrossTasks> profile_;
 
   // A flag to skip the initialization sequence of SyncFileSystemService for
   // testing.

chrome/browser/ui/bookmarks/bookmark_tab_helper.h

@@ -104,7 +104,7 @@ class BookmarkTabHelper
 
   // The BookmarkDrag is used to forward bookmark drag and drop events to
   // extensions.
-  raw_ptr<BookmarkDrag, DanglingUntriaged> bookmark_drag_;
+  raw_ptr<BookmarkDrag, DanglingAcrossTasks> bookmark_drag_;
 
   WEB_CONTENTS_USER_DATA_KEY_DECL();
 };

chrome/browser/ui/browser.h

@@ -247,7 +247,7 @@ class Browser : public TabStripModelObserver,
     Type type;
 
     // The associated profile.
-    raw_ptr<Profile, DanglingUntriaged> profile;
+    raw_ptr<Profile, DanglingAcrossTasks> profile;
 
     // Specifies the browser `is_trusted_source_` value.
     bool trusted_source = false;
@@ -1189,7 +1189,7 @@ class Browser : public TabStripModelObserver,
   const Type type_;
 
   // This Browser's profile.
-  const raw_ptr<Profile, DanglingUntriaged> profile_;
+  const raw_ptr<Profile, DanglingAcrossTasks> profile_;
 
   // Prevent Profile deletion until this browser window is closed.
   std::unique_ptr<ScopedProfileKeepAlive> profile_keep_alive_;

chrome/browser/ui/passwords/manage_passwords_state.h

@@ -163,7 +163,7 @@ class ManagePasswordsState {
   password_manager::ui::State state_;
 
   // The client used for logging.
-  raw_ptr<password_manager::PasswordManagerClient, DanglingUntriaged> client_;
+  raw_ptr<password_manager::PasswordManagerClient, DanglingAcrossTasks> client_;
 
   // Whether the last attempt to authenticate to opt-in using password account
   // storage failed.

chrome/browser/ui/tabs/tab_strip_model.cc

@@ -270,7 +270,7 @@ struct TabStripModel::DetachNotifications {
   //
   // Once the notification for change of active web contents has been sent,
   // this field is set to nullptr.
-  raw_ptr<WebContents, DanglingUntriaged> initially_active_web_contents =
+  raw_ptr<WebContents, DanglingAcrossTasks> initially_active_web_contents =
       nullptr;
 
   // The WebContents that were recently detached. Observers need to be notified

chrome/browser/ui/tabs/tab_strip_model.h

@@ -114,7 +114,7 @@ class TabStripModel : public TabGroupController {
     // guaranteed to be valid for the life time of the notification (and
     // possibly longer).
     std::unique_ptr<content::WebContents> owned_contents;
-    raw_ptr<content::WebContents, DanglingUntriaged> contents;
+    raw_ptr<content::WebContents, DanglingAcrossTasks> contents;
 
     // The index of the WebContents in the original selection model of the tab
     // strip [prior to any tabs being removed, if multiple tabs are being
@@ -819,7 +819,7 @@ class TabStripModel : public TabGroupController {
   base::ObserverList<TabStripModelObserver>::Unchecked observers_;
 
   // A profile associated with this TabStripModel.
-  raw_ptr<Profile, DanglingUntriaged> profile_;
+  raw_ptr<Profile, DanglingAcrossTasks> profile_;
 
   // True if all tabs are currently being closed via CloseAllTabs.
   bool closing_all_ = false;

chrome/browser/ui/tabs/tab_strip_model_observer.h

@@ -230,7 +230,7 @@ struct TabStripSelectionChange {
     return selected_tabs_were_removed || old_model != new_model;
   }
 
-  raw_ptr<content::WebContents, DanglingUntriaged> old_contents = nullptr;
+  raw_ptr<content::WebContents, DanglingAcrossTasks> old_contents = nullptr;
   raw_ptr<content::WebContents, DanglingUntriaged> new_contents = nullptr;
 
   ui::ListSelectionModel old_model;

chrome/browser/ui/views/bookmarks/bookmark_bar_view.h

@@ -370,7 +370,8 @@ class BookmarkBarView : public views::AccessiblePaneView,
   PrefChangeRegistrar profile_pref_registrar_;
 
   // Used for opening urls.
-  raw_ptr<content::PageNavigator, DanglingUntriaged> page_navigator_ = nullptr;
+  raw_ptr<content::PageNavigator, DanglingAcrossTasks> page_navigator_ =
+      nullptr;
 
   // BookmarkModel that owns the entries and folders that are shown in this
   // view. This is owned by the Profile.

chrome/browser/ui/views/bookmarks/saved_tab_groups/saved_tab_group_bar.h

@@ -167,7 +167,7 @@ class SavedTabGroupBar : public views::AccessiblePaneView,
   // Provides a callback that returns the page navigator
   base::RepeatingCallback<content::PageNavigator*()> GetPageNavigatorGetter();
 
-  raw_ptr<views::MenuButton, DanglingUntriaged> overflow_button_;
+  raw_ptr<views::MenuButton, DanglingAcrossTasks> overflow_button_;
 
   // Used to show the overflow menu when clicked.
   raw_ptr<views::BubbleDialogDelegate> bubble_delegate_ = nullptr;
@@ -176,7 +176,8 @@ class SavedTabGroupBar : public views::AccessiblePaneView,
   raw_ptr<SavedTabGroupModel> saved_tab_group_model_;
 
   // The page navigator used to create tab groups
-  raw_ptr<content::PageNavigator, DanglingUntriaged> page_navigator_ = nullptr;
+  raw_ptr<content::PageNavigator, DanglingAcrossTasks> page_navigator_ =
+      nullptr;
   raw_ptr<Browser> browser_;
 
   // During a drag and drop session, `drag_data_` owns the state for the drag.

chrome/browser/ui/views/extensions/extensions_toolbar_container.h

@@ -318,7 +318,8 @@ class ExtensionsToolbarContainer
   // `extensions_features::kExtensionsMenuAccessControl` experiment is released.
   // Exactly one of `extensions_button_ and `extensions_controls_` is created;
   // the other is null.
-  const raw_ptr<ExtensionsToolbarButton, DanglingUntriaged> extensions_button_;
+  const raw_ptr<ExtensionsToolbarButton, DanglingAcrossTasks>
+      extensions_button_;
   const raw_ptr<ExtensionsToolbarControls, DanglingUntriaged>
       extensions_controls_;
   DisplayMode display_mode_;

chrome/browser/ui/views/frame/browser_root_view.h

@@ -138,7 +138,7 @@ class BrowserRootView : public views::internal::RootView {
       std::unique_ptr<ui::LayerTreeOwner> drag_image_layer_owner);
 
   // The BrowserView.
-  raw_ptr<BrowserView, DanglingUntriaged> browser_view_ = nullptr;
+  raw_ptr<BrowserView, DanglingAcrossTasks> browser_view_ = nullptr;
 
   // Used to calculate partial offsets in scrolls that occur for a smooth
   // scroll device.

chrome/browser/ui/views/frame/browser_view.h

@@ -993,7 +993,7 @@ class BrowserView : public BrowserWindow,
   // The view that manages the tab strip, toolbar, and sometimes the bookmark
   // bar. Stacked top in the view hiearachy so it can be used to slide out
   // the top views in immersive fullscreen.
-  raw_ptr<TopContainerView, DanglingUntriaged> top_container_ = nullptr;
+  raw_ptr<TopContainerView, DanglingAcrossTasks> top_container_ = nullptr;
 
   // Menu button and page status icons. Only used by web-app windows.
   raw_ptr<WebAppFrameToolbarView, DanglingUntriaged> web_app_frame_toolbar_ =
@@ -1006,11 +1006,11 @@ class BrowserView : public BrowserWindow,
   raw_ptr<views::Label, DanglingUntriaged> web_app_window_title_ = nullptr;
 
   // The view that contains the tabstrip, new tab button, and grab handle space.
-  raw_ptr<TabStripRegionView, DanglingUntriaged> tab_strip_region_view_ =
+  raw_ptr<TabStripRegionView, DanglingAcrossTasks> tab_strip_region_view_ =
       nullptr;
 
   // The TabStrip.
-  raw_ptr<TabStrip, DanglingUntriaged> tabstrip_ = nullptr;
+  raw_ptr<TabStrip, DanglingAcrossTasks> tabstrip_ = nullptr;
 
   // the webui based tabstrip, when applicable. see https://crbug.com/989131.
   raw_ptr<WebUITabStripContainerView, DanglingUntriaged> webui_tab_strip_ =
@@ -1024,7 +1024,7 @@ class BrowserView : public BrowserWindow,
   std::unique_ptr<AccessibilityModeObserver> accessibility_mode_observer_;
 
   // The Toolbar containing the navigation buttons, menus and the address bar.
-  raw_ptr<ToolbarView, DanglingUntriaged> toolbar_ = nullptr;
+  raw_ptr<ToolbarView, DanglingAcrossTasks> toolbar_ = nullptr;
 
   // The OverlayView for the widget, which is used to host `top_container_`
   // during immersive reveal.
@@ -1059,7 +1059,7 @@ class BrowserView : public BrowserWindow,
   std::unique_ptr<BookmarkBarView> bookmark_bar_view_;
 
   // Separator between top container and contents.
-  raw_ptr<views::View, DanglingUntriaged> contents_separator_ = nullptr;
+  raw_ptr<views::View, DanglingAcrossTasks> contents_separator_ = nullptr;
 
   // Loading bar (part of top container for / WebUI tab strip).
   raw_ptr<TopContainerLoadingBar, DanglingUntriaged> loading_bar_ = nullptr;
@@ -1067,37 +1067,38 @@ class BrowserView : public BrowserWindow,
   // The do-nothing view which controls the z-order of the find bar widget
   // relative to views which paint into layers and views with an associated
   // NativeView.
-  raw_ptr<View, DanglingUntriaged> find_bar_host_view_ = nullptr;
+  raw_ptr<View, DanglingAcrossTasks> find_bar_host_view_ = nullptr;
 
   // The download shelf.
   raw_ptr<DownloadShelf, DanglingUntriaged> download_shelf_ = nullptr;
 
   // The InfoBarContainerView that contains InfoBars for the current tab.
-  raw_ptr<InfoBarContainerView, DanglingUntriaged> infobar_container_ = nullptr;
+  raw_ptr<InfoBarContainerView, DanglingAcrossTasks> infobar_container_ =
+      nullptr;
 
   // The view that contains the selected WebContents.
-  raw_ptr<ContentsWebView, DanglingUntriaged> contents_web_view_ = nullptr;
+  raw_ptr<ContentsWebView, DanglingAcrossTasks> contents_web_view_ = nullptr;
 
   // The view that contains devtools window for the selected WebContents.
-  raw_ptr<views::WebView, DanglingUntriaged> devtools_web_view_ = nullptr;
+  raw_ptr<views::WebView, DanglingAcrossTasks> devtools_web_view_ = nullptr;
 
   // The view managing the devtools and contents positions.
   // Handled by ContentsLayoutManager.
-  raw_ptr<views::View, DanglingUntriaged> contents_container_ = nullptr;
+  raw_ptr<views::View, DanglingAcrossTasks> contents_container_ = nullptr;
 
   // The side panel aligned to the left or the right side of the browser window
   // depending on the kSidePanelHorizontalAlignment pref's value.
-  raw_ptr<SidePanel, DanglingUntriaged> unified_side_panel_ = nullptr;
-  raw_ptr<views::View, DanglingUntriaged> right_aligned_side_panel_separator_ =
-      nullptr;
+  raw_ptr<SidePanel, DanglingAcrossTasks> unified_side_panel_ = nullptr;
+  raw_ptr<views::View, DanglingAcrossTasks>
+      right_aligned_side_panel_separator_ = nullptr;
 
   // The side search side panel.
-  raw_ptr<views::View, DanglingUntriaged> left_aligned_side_panel_separator_ =
+  raw_ptr<views::View, DanglingAcrossTasks> left_aligned_side_panel_separator_ =
       nullptr;
 
   // Provides access to the toolbar buttons this browser view uses. Buttons may
   // appear in a hosted app frame or in a tabbed UI toolbar.
-  raw_ptr<ToolbarButtonProvider, DanglingUntriaged> toolbar_button_provider_ =
+  raw_ptr<ToolbarButtonProvider, DanglingAcrossTasks> toolbar_button_provider_ =
       nullptr;
 
   // The handler responsible for showing autofill bubbles.

chrome/browser/ui/views/frame/browser_view_layout.h

@@ -175,27 +175,27 @@ class BrowserViewLayout : public views::LayoutManager {
   // Child views that the layout manager manages.
   // NOTE: If you add a view, try to add it as a views::View, which makes
   // testing much easier.
-  const raw_ptr<views::View, DanglingUntriaged> top_container_;
+  const raw_ptr<views::View, DanglingAcrossTasks> top_container_;
   const raw_ptr<WebAppFrameToolbarView, DanglingUntriaged>
       web_app_frame_toolbar_;
   const raw_ptr<views::Label, DanglingUntriaged> web_app_window_title_;
-  const raw_ptr<TabStripRegionView, DanglingUntriaged> tab_strip_region_view_;
-  const raw_ptr<views::View, DanglingUntriaged> toolbar_;
-  const raw_ptr<InfoBarContainerView, DanglingUntriaged> infobar_container_;
-  const raw_ptr<views::View, DanglingUntriaged> contents_container_;
-  const raw_ptr<views::View, DanglingUntriaged>
+  const raw_ptr<TabStripRegionView, DanglingAcrossTasks> tab_strip_region_view_;
+  const raw_ptr<views::View, DanglingAcrossTasks> toolbar_;
+  const raw_ptr<InfoBarContainerView, DanglingAcrossTasks> infobar_container_;
+  const raw_ptr<views::View, DanglingAcrossTasks> contents_container_;
+  const raw_ptr<views::View, DanglingAcrossTasks>
       left_aligned_side_panel_separator_;
-  const raw_ptr<views::View, DanglingUntriaged> unified_side_panel_;
-  const raw_ptr<views::View, DanglingUntriaged>
+  const raw_ptr<views::View, DanglingAcrossTasks> unified_side_panel_;
+  const raw_ptr<views::View, DanglingAcrossTasks>
       right_aligned_side_panel_separator_;
-  const raw_ptr<ImmersiveModeController, DanglingUntriaged>
+  const raw_ptr<ImmersiveModeController, DanglingAcrossTasks>
       immersive_mode_controller_;
-  const raw_ptr<views::View, DanglingUntriaged> contents_separator_;
+  const raw_ptr<views::View, DanglingAcrossTasks> contents_separator_;
 
   raw_ptr<views::View, DanglingUntriaged> webui_tab_strip_ = nullptr;
   raw_ptr<views::View, DanglingUntriaged> loading_bar_ = nullptr;
-  raw_ptr<TabStrip, DanglingUntriaged> tab_strip_ = nullptr;
-  raw_ptr<BookmarkBarView, DanglingUntriaged> bookmark_bar_ = nullptr;
+  raw_ptr<TabStrip, DanglingAcrossTasks> tab_strip_ = nullptr;
+  raw_ptr<BookmarkBarView, DanglingAcrossTasks> bookmark_bar_ = nullptr;
   raw_ptr<views::View, DanglingUntriaged> download_shelf_ = nullptr;
 
   // The widget displaying a border on top of contents container for

chrome/browser/ui/views/frame/desktop_browser_frame_aura.h

@@ -66,7 +66,7 @@ class DesktopBrowserFrameAura : public views::DesktopNativeWidgetAura,
   raw_ptr<BrowserFrame> browser_frame_;
 
   // Owned by the RootWindow.
-  raw_ptr<BrowserDesktopWindowTreeHost, DanglingUntriaged>
+  raw_ptr<BrowserDesktopWindowTreeHost, DanglingAcrossTasks>
       browser_desktop_window_tree_host_;
 
   std::unique_ptr<wm::VisibilityController> visibility_controller_;

chrome/browser/ui/views/frame/tab_strip_region_view.h

@@ -85,9 +85,9 @@ class TabStripRegionView final : public views::AccessiblePaneView {
   void UpdateNewTabButtonBorder();
 
   raw_ptr<views::FlexLayout, DanglingUntriaged> layout_manager_ = nullptr;
-  raw_ptr<views::View, DanglingUntriaged> tab_strip_container_ = nullptr;
+  raw_ptr<views::View, DanglingAcrossTasks> tab_strip_container_ = nullptr;
   raw_ptr<views::View, DanglingUntriaged> reserved_grab_handle_space_ = nullptr;
-  raw_ptr<TabStrip, DanglingUntriaged> tab_strip_ = nullptr;
+  raw_ptr<TabStrip, DanglingAcrossTasks> tab_strip_ = nullptr;
   raw_ptr<TabStripScrollContainer, DanglingUntriaged>
       tab_strip_scroll_container_ = nullptr;
   raw_ptr<NewTabButton, DanglingUntriaged> new_tab_button_ = nullptr;

chrome/browser/ui/views/frame/web_contents_close_handler.h

@@ -43,7 +43,7 @@ class WebContentsCloseHandler {
   // close was canceled.
   void OnStillHaventClosed();
 
-  raw_ptr<WebContentsCloseHandlerDelegate, DanglingUntriaged> delegate_;
+  raw_ptr<WebContentsCloseHandlerDelegate, DanglingAcrossTasks> delegate_;
 
   // If true, WillCloseAllTabs() has been invoked.
   bool in_close_;

chrome/browser/ui/views/performance_controls/battery_saver_button_browsertest.cc

@@ -96,9 +96,9 @@ class BatterySaverHelpPromoTest : public InProcessBrowserTest {
   }
 
  private:
-  raw_ptr<base::test::TestSamplingEventSource, DanglingUntriaged>
+  raw_ptr<base::test::TestSamplingEventSource, DanglingAcrossTasks>
       sampling_source_;
-  raw_ptr<base::test::TestBatteryLevelProvider, DanglingUntriaged>
+  raw_ptr<base::test::TestBatteryLevelProvider, DanglingAcrossTasks>
       battery_level_provider_;
   // Only used on platforms without a battery level provider implementation.
   std::unique_ptr<base::BatteryStateSampler> battery_state_sampler_;

chrome/browser/ui/views/sharing/sharing_icon_view.h

@@ -58,7 +58,7 @@ class SharingIconView : public PageActionIconView {
   void UpdateOpacity();
 
  private:
-  raw_ptr<SharingUiController, DanglingUntriaged> last_controller_ = nullptr;
+  raw_ptr<SharingUiController, DanglingAcrossTasks> last_controller_ = nullptr;
   bool loading_animation_ = false;
   bool should_show_error_ = false;
   GetControllerCallback get_controller_callback_;

chrome/browser/ui/views/status_bubble_views.h

@@ -153,7 +153,7 @@ class StatusBubbleViews : public StatusBubble {
   // going outside the bounds of the hosting widget.
   std::unique_ptr<views::Widget> popup_;
 
-  raw_ptr<views::View, DanglingUntriaged> base_view_;
+  raw_ptr<views::View, DanglingAcrossTasks> base_view_;
   raw_ptr<StatusView, DanglingUntriaged> view_ = nullptr;
 
   // Manages the expansion of a status bubble to fit a long URL.

chrome/browser/ui/views/tabs/new_tab_button.h

@@ -91,7 +91,7 @@ class NewTabButton : public views::ImageButton,
   void PaintFill(gfx::Canvas* canvas) const;
 
   // Tab strip that contains this button.
-  raw_ptr<TabStrip, DanglingUntriaged> tab_strip_;
+  raw_ptr<TabStrip, DanglingAcrossTasks> tab_strip_;
 
   // Contains our ink drop layer so it can paint above our background.
   raw_ptr<views::InkDropContainerView, DanglingUntriaged> ink_drop_container_;

chrome/browser/ui/views/tabs/tab.cc

@@ -137,7 +137,7 @@ class TabStyleHighlightPathGenerator : public views::HighlightPathGenerator {
   }
 
  private:
-  const raw_ptr<TabStyleViews, DanglingUntriaged> tab_style_views_;
+  const raw_ptr<TabStyleViews, DanglingAcrossTasks> tab_style_views_;
 };
 
 }  // namespace

chrome/browser/ui/views/tabs/tab_container_impl.h

@@ -336,7 +336,7 @@ class TabContainerImpl : public TabContainer,
 
   const raw_ref<TabContainerController, DanglingUntriaged> controller_;
 
-  const raw_ptr<TabHoverCardController, DanglingUntriaged>
+  const raw_ptr<TabHoverCardController, DanglingAcrossTasks>
       hover_card_controller_;
 
   // May be nullptr in tests.
@@ -351,7 +351,7 @@ class TabContainerImpl : public TabContainer,
   // This view is animated by `bounds_animator_` to guarantee that this
   // container's bounds change smoothly when tabs are animated into or out of
   // this container.
-  const raw_ref<views::View, DanglingUntriaged> overall_bounds_view_;
+  const raw_ref<views::View, DanglingAcrossTasks> overall_bounds_view_;
 
   // Responsible for animating tabs in response to model changes.
   views::BoundsAnimator bounds_animator_;

chrome/browser/ui/views/tabs/tab_slot_animation_delegate.h

@@ -28,7 +28,7 @@ class TabSlotAnimationDelegate : public gfx::AnimationDelegate {
 
  private:
   const raw_ptr<TabContainer, DanglingUntriaged> tab_container_;
-  const raw_ptr<TabSlotView, DanglingUntriaged> slot_view_;
+  const raw_ptr<TabSlotView, DanglingAcrossTasks> slot_view_;
 };
 
 #endif  // CHROME_BROWSER_UI_VIEWS_TABS_TAB_SLOT_ANIMATION_DELEGATE_H_

chrome/browser/ui/views/tabs/tab_strip.h

@@ -421,10 +421,10 @@ class TabStrip : public views::View,
 
   std::unique_ptr<TabHoverCardController> hover_card_controller_;
 
-  raw_ref<TabDragContextImpl, DanglingUntriaged> drag_context_;
+  raw_ref<TabDragContextImpl, DanglingAcrossTasks> drag_context_;
 
   // The View parent for the tabs and the various group views.
-  raw_ref<TabContainer, DanglingUntriaged> tab_container_;
+  raw_ref<TabContainer, DanglingAcrossTasks> tab_container_;
 
   // The background offset used by inactive tabs to match the frame image.
   int background_offset_ = 0;

chrome/browser/ui/views/toolbar/chrome_labs_button.h

@@ -44,7 +44,7 @@ class ChromeLabsButton : public ToolbarButton {
 
   raw_ptr<BrowserView, DanglingUntriaged> browser_view_;
 
-  raw_ptr<const ChromeLabsModel, DanglingUntriaged> model_;
+  raw_ptr<const ChromeLabsModel, DanglingAcrossTasks> model_;
 
   raw_ptr<views::DotIndicator> new_experiments_indicator_;
 

chrome/browser/ui/views/toolbar/chrome_labs_coordinator.h

@@ -64,7 +64,7 @@ class ChromeLabsCoordinator : public views::ViewObserver {
 
   raw_ptr<ChromeLabsButton, DanglingUntriaged> anchor_view_;
   raw_ptr<Browser, DanglingUntriaged> browser_;
-  raw_ptr<const ChromeLabsModel, DanglingUntriaged> chrome_labs_model_;
+  raw_ptr<const ChromeLabsModel, DanglingAcrossTasks> chrome_labs_model_;
   raw_ptr<ChromeLabsBubbleView, DanglingUntriaged> chrome_labs_bubble_view_ =
       nullptr;
 

chrome/browser/ui/views/toolbar/toolbar_icon_container_view.h

@@ -112,7 +112,7 @@ class ToolbarIconContainerView : public views::View,
 
   // The main view is nominally always present and is last child in the view
   // hierarchy.
-  raw_ptr<views::View, DanglingUntriaged> main_item_ = nullptr;
+  raw_ptr<views::View, DanglingAcrossTasks> main_item_ = nullptr;
 
   // Override for the icon color. If not set, |kColorToolbarButtonIcon| is used.
   absl::optional<SkColor> icon_color_;

chrome/browser/ui/web_applications/web_app_ui_manager_impl.h

@@ -108,7 +108,7 @@ class WebAppUiManagerImpl : public BrowserListObserver, public WebAppUiManager {
   const raw_ptr<Profile> profile_;
 
   raw_ptr<WebAppSyncBridge> sync_bridge_ = nullptr;
-  raw_ptr<OsIntegrationManager, DanglingUntriaged> os_integration_manager_ =
+  raw_ptr<OsIntegrationManager, DanglingAcrossTasks> os_integration_manager_ =
       nullptr;
 
   std::map<AppId, std::vector<base::OnceClosure>> windows_closed_requests_map_;

chrome/browser/web_applications/externally_managed_app_manager.h

@@ -256,9 +256,9 @@ class ExternallyManagedAppManager {
 
   base::OnceClosure registrations_complete_callback_;
 
-  raw_ptr<WebAppUiManager, DanglingUntriaged> ui_manager_ = nullptr;
-  raw_ptr<WebAppInstallFinalizer, DanglingUntriaged> finalizer_ = nullptr;
-  raw_ptr<WebAppCommandScheduler, DanglingUntriaged> command_scheduler_ =
+  raw_ptr<WebAppUiManager, DanglingAcrossTasks> ui_manager_ = nullptr;
+  raw_ptr<WebAppInstallFinalizer, DanglingAcrossTasks> finalizer_ = nullptr;
+  raw_ptr<WebAppCommandScheduler, DanglingAcrossTasks> command_scheduler_ =
       nullptr;
 
   const raw_ptr<Profile> profile_;

chrome/browser/web_applications/manifest_update_manager.h

@@ -191,13 +191,13 @@ class ManifestUpdateManager final : public WebAppInstallManagerObserver {
   static bool& BypassWindowCloseWaitingForTesting();
 
   raw_ptr<WebAppRegistrar, DanglingUntriaged> registrar_ = nullptr;
-  raw_ptr<WebAppUiManager, DanglingUntriaged> ui_manager_ = nullptr;
+  raw_ptr<WebAppUiManager, DanglingAcrossTasks> ui_manager_ = nullptr;
 #if BUILDFLAG(IS_CHROMEOS_ASH)
   raw_ptr<const ash::SystemWebAppDelegateMap, DanglingUntriaged>
       system_web_apps_delegate_map_ = nullptr;
 #endif
-  raw_ptr<WebAppInstallManager, DanglingUntriaged> install_manager_ = nullptr;
-  raw_ptr<WebAppCommandScheduler, DanglingUntriaged> command_scheduler_ =
+  raw_ptr<WebAppInstallManager, DanglingAcrossTasks> install_manager_ = nullptr;
+  raw_ptr<WebAppCommandScheduler, DanglingAcrossTasks> command_scheduler_ =
       nullptr;
 
   base::ScopedObservation<WebAppInstallManager, WebAppInstallManagerObserver>

chrome/browser/web_applications/os_integration/web_app_shortcut_manager.h

@@ -173,11 +173,11 @@ class WebAppShortcutManager {
 
   const raw_ptr<Profile> profile_;
 
-  raw_ptr<WebAppRegistrar, DanglingUntriaged> registrar_ = nullptr;
-  raw_ptr<WebAppIconManager, DanglingUntriaged> icon_manager_ = nullptr;
-  raw_ptr<WebAppFileHandlerManager, DanglingUntriaged> file_handler_manager_ =
+  raw_ptr<WebAppRegistrar, DanglingAcrossTasks> registrar_ = nullptr;
+  raw_ptr<WebAppIconManager, DanglingAcrossTasks> icon_manager_ = nullptr;
+  raw_ptr<WebAppFileHandlerManager, DanglingAcrossTasks> file_handler_manager_ =
       nullptr;
-  raw_ptr<WebAppProtocolHandlerManager, DanglingUntriaged>
+  raw_ptr<WebAppProtocolHandlerManager, DanglingAcrossTasks>
       protocol_handler_manager_ = nullptr;
 
   base::WeakPtrFactory<WebAppShortcutManager> weak_ptr_factory_{this};

chrome/browser/web_applications/policy/web_app_policy_manager.h

@@ -189,7 +189,7 @@ class WebAppPolicyManager {
   raw_ptr<const ash::SystemWebAppDelegateMap, DanglingUntriaged>
       system_web_apps_delegate_map_ = nullptr;
 #endif
-  raw_ptr<OsIntegrationManager, DanglingUntriaged> os_integration_manager_ =
+  raw_ptr<OsIntegrationManager, DanglingAcrossTasks> os_integration_manager_ =
       nullptr;
   PrefChangeRegistrar pref_change_registrar_;
   PrefChangeRegistrar local_state_pref_change_registrar_;

chrome/browser/web_applications/preinstalled_web_app_manager.h

@@ -175,8 +175,8 @@ class PreinstalledWebAppManager {
       int force_reinstall_for_milestone);
 
   raw_ptr<WebAppRegistrar, DanglingUntriaged> registrar_ = nullptr;
-  raw_ptr<const WebAppUiManager, DanglingUntriaged> ui_manager_ = nullptr;
-  raw_ptr<ExternallyManagedAppManager, DanglingUntriaged>
+  raw_ptr<const WebAppUiManager, DanglingAcrossTasks> ui_manager_ = nullptr;
+  raw_ptr<ExternallyManagedAppManager, DanglingAcrossTasks>
       externally_managed_app_manager_ = nullptr;
   const raw_ptr<Profile> profile_;
 

chrome/browser/web_applications/web_app_icon_manager.h

@@ -242,7 +242,7 @@ class WebAppIconManager : public WebAppInstallManagerObserver {
                                  gfx::ImageSkia converted_image);
 
   raw_ptr<WebAppRegistrar, DanglingUntriaged> registrar_;
-  raw_ptr<WebAppInstallManager, DanglingUntriaged> install_manager_;
+  raw_ptr<WebAppInstallManager, DanglingAcrossTasks> install_manager_;
   base::FilePath web_apps_directory_;
   scoped_refptr<FileUtilsWrapper> utils_;
   scoped_refptr<base::SequencedTaskRunner> icon_task_runner_;

chrome/browser/web_applications/web_app_install_finalizer.h

@@ -243,18 +243,18 @@ class WebAppInstallFinalizer {
       const AppId& app_id,
       const WebAppInstallInfo& new_web_app_info);
 
-  raw_ptr<WebAppInstallManager, DanglingUntriaged> install_manager_ = nullptr;
+  raw_ptr<WebAppInstallManager, DanglingAcrossTasks> install_manager_ = nullptr;
   raw_ptr<WebAppRegistrar, DanglingUntriaged> registrar_ = nullptr;
   raw_ptr<WebAppSyncBridge, DanglingUntriaged> sync_bridge_ = nullptr;
-  raw_ptr<WebAppUiManager, DanglingUntriaged> ui_manager_ = nullptr;
-  raw_ptr<OsIntegrationManager, DanglingUntriaged> os_integration_manager_ =
+  raw_ptr<WebAppUiManager, DanglingAcrossTasks> ui_manager_ = nullptr;
+  raw_ptr<OsIntegrationManager, DanglingAcrossTasks> os_integration_manager_ =
       nullptr;
   raw_ptr<WebAppIconManager, DanglingUntriaged> icon_manager_ = nullptr;
-  raw_ptr<WebAppPolicyManager, DanglingUntriaged> policy_manager_ = nullptr;
+  raw_ptr<WebAppPolicyManager, DanglingAcrossTasks> policy_manager_ = nullptr;
   raw_ptr<WebAppTranslationManager, DanglingUntriaged> translation_manager_ =
       nullptr;
-  raw_ptr<WebAppCommandManager, DanglingUntriaged> command_manager_ = nullptr;
-  raw_ptr<WebAppOriginAssociationManager, DanglingUntriaged>
+  raw_ptr<WebAppCommandManager, DanglingAcrossTasks> command_manager_ = nullptr;
+  raw_ptr<WebAppOriginAssociationManager, DanglingAcrossTasks>
       origin_association_manager_ = nullptr;
 
   const raw_ptr<Profile> profile_;

chrome/browser/web_applications/web_app_registrar.h

@@ -530,8 +530,8 @@ class WebAppRegistrar : public ProfileManagerObserver {
 
  private:
   const raw_ptr<Profile> profile_;
-  raw_ptr<WebAppPolicyManager, DanglingUntriaged> policy_manager_ = nullptr;
-  raw_ptr<WebAppTranslationManager, DanglingUntriaged> translation_manager_ =
+  raw_ptr<WebAppPolicyManager, DanglingAcrossTasks> policy_manager_ = nullptr;
+  raw_ptr<WebAppTranslationManager, DanglingAcrossTasks> translation_manager_ =
       nullptr;
 
   base::ScopedObservation<ProfileManager, ProfileManagerObserver>

chrome/browser/web_applications/web_app_sync_bridge.h

@@ -226,9 +226,9 @@ class WebAppSyncBridge : public syncer::ModelTypeSyncBridge {
 
   std::unique_ptr<WebAppDatabase> database_;
   const raw_ptr<WebAppRegistrarMutable, DanglingUntriaged> registrar_;
-  raw_ptr<WebAppCommandManager, DanglingUntriaged> command_manager_;
-  raw_ptr<WebAppCommandScheduler, DanglingUntriaged> command_scheduler_;
-  raw_ptr<WebAppInstallManager, DanglingUntriaged> install_manager_;
+  raw_ptr<WebAppCommandManager, DanglingAcrossTasks> command_manager_;
+  raw_ptr<WebAppCommandScheduler, DanglingAcrossTasks> command_scheduler_;
+  raw_ptr<WebAppInstallManager, DanglingAcrossTasks> install_manager_;
 
   base::OneShotEvent on_sync_connected_;
 

chrome/test/base/in_process_browser_test.h

@@ -387,7 +387,7 @@ class InProcessBrowserTest : public content::BrowserTestBase {
   // If no browser is created in BrowserMain(), then |browser_| will remain
   // nullptr unless SelectFirstBrowser() is called after the creation of the
   // first browser instance at a later time.
-  raw_ptr<Browser, DanglingUntriaged> browser_ = nullptr;
+  raw_ptr<Browser, DanglingAcrossTasks> browser_ = nullptr;
 
   // Used to run the process until the BrowserProcess signals the test to quit.
   std::unique_ptr<base::RunLoop> run_loop_;

components/autofill/core/browser/payments/credit_card_access_manager.h

@@ -453,7 +453,7 @@ class CreditCardAccessManager : public CreditCardCvcAuthenticator::Requester,
   raw_ptr<PersonalDataManager> personal_data_manager_;
 
   // For logging metrics.
-  raw_ptr<autofill_metrics::CreditCardFormEventLogger, DanglingUntriaged>
+  raw_ptr<autofill_metrics::CreditCardFormEventLogger, DanglingAcrossTasks>
       form_event_logger_;
 
   // Timestamp used for preflight call metrics.

components/bookmarks/browser/bookmark_model.h

@@ -483,12 +483,12 @@ class BookmarkModel final : public BookmarkUndoProvider,
   // |owned_root_|. Once loading has completed, |owned_root_| is destroyed and
   // this is set to url_index_->root(). |owned_root_| is done as lots of
   // existing code assumes the root is non-null while loading.
-  raw_ptr<BookmarkNode, DanglingUntriaged> root_ = nullptr;
+  raw_ptr<BookmarkNode, DanglingAcrossTasks> root_ = nullptr;
 
-  raw_ptr<BookmarkPermanentNode, DanglingUntriaged> bookmark_bar_node_ =
+  raw_ptr<BookmarkPermanentNode, DanglingAcrossTasks> bookmark_bar_node_ =
       nullptr;
-  raw_ptr<BookmarkPermanentNode, DanglingUntriaged> other_node_ = nullptr;
-  raw_ptr<BookmarkPermanentNode, DanglingUntriaged> mobile_node_ = nullptr;
+  raw_ptr<BookmarkPermanentNode, DanglingAcrossTasks> other_node_ = nullptr;
+  raw_ptr<BookmarkPermanentNode, DanglingAcrossTasks> mobile_node_ = nullptr;
 
   // The maximum ID assigned to the bookmark nodes in the model.
   int64_t next_node_id_ = 1;

components/download/internal/background_service/scheduler/scheduler_impl.h

@@ -54,7 +54,7 @@ class SchedulerImpl : public Scheduler {
       const DeviceStatus& device_status);
 
   // Used to create platform dependent background tasks.
-  raw_ptr<TaskScheduler, DanglingUntriaged> task_scheduler_;
+  raw_ptr<TaskScheduler, DanglingAcrossTasks> task_scheduler_;
 
   // Download service configuration.
   raw_ptr<Configuration, DanglingUntriaged> config_;

components/gcm_driver/instance_id/instance_id_driver.h

@@ -48,7 +48,7 @@ class InstanceIDDriver {
  private:
   // Owned by GCMProfileServiceFactory, which is a dependency of
   // InstanceIDProfileServiceFactory, which owns this.
-  raw_ptr<gcm::GCMDriver, DanglingUntriaged> gcm_driver_;
+  raw_ptr<gcm::GCMDriver, DanglingAcrossTasks> gcm_driver_;
 
   std::map<std::string, std::unique_ptr<InstanceID>> instance_id_map_;
 };

components/history/core/browser/expire_history_backend.h

@@ -275,9 +275,9 @@ class ExpireHistoryBackend {
   raw_ptr<HistoryBackendNotifier> notifier_;
 
   // Non-owning pointers to the databases we deal with (MAY BE NULL).
-  raw_ptr<HistoryDatabase, DanglingUntriaged>
+  raw_ptr<HistoryDatabase, DanglingAcrossTasks>
       main_db_;  // Main history database.
-  raw_ptr<favicon::FaviconDatabase, DanglingUntriaged> favicon_db_;
+  raw_ptr<favicon::FaviconDatabase, DanglingAcrossTasks> favicon_db_;
 
   // The threshold for "old" history where we will automatically delete it.
   base::TimeDelta expiration_threshold_;
@@ -304,7 +304,7 @@ class ExpireHistoryBackend {
   std::unique_ptr<ExpiringVisitsReader> auto_subframe_visits_reader_;
 
   // The HistoryBackendClient; may be null.
-  raw_ptr<HistoryBackendClient, DanglingUntriaged> backend_client_;
+  raw_ptr<HistoryBackendClient, DanglingAcrossTasks> backend_client_;
 
   scoped_refptr<base::SequencedTaskRunner> task_runner_;
 

components/history/core/browser/sync/history_sync_bridge.h

@@ -154,7 +154,7 @@ class HistorySyncBridge : public syncer::ModelTypeSyncBridge,
 
   // A non-owning pointer to the database, which is for storing sync metadata
   // and state. Can be null in case of unrecoverable database errors.
-  raw_ptr<HistorySyncMetadataDatabase, DanglingUntriaged>
+  raw_ptr<HistorySyncMetadataDatabase, DanglingAcrossTasks>
       sync_metadata_database_;
 
   // HistoryBackend uses SequencedTaskRunner, so this makes sure

components/history/core/browser/sync/typed_url_sync_bridge.h

@@ -245,7 +245,7 @@ class TypedURLSyncBridge : public syncer::ModelTypeSyncBridge,
 
   // A non-owning pointer to the database, which is for storing typed urls sync
   // metadata and state.
-  raw_ptr<TypedURLSyncMetadataDatabase, DanglingUntriaged>
+  raw_ptr<TypedURLSyncMetadataDatabase, DanglingAcrossTasks>
       sync_metadata_database_;
 
   // Since HistoryBackend use SequencedTaskRunner, so should use SequenceChecker

components/leveldb_proto/internal/proto_leveldb_wrapper.h

@@ -151,7 +151,7 @@ class COMPONENT_EXPORT(LEVELDB_PROTO) ProtoLevelDBWrapper {
   // Used to run blocking tasks in-order, must be the TaskRunner that |db_|
   // relies on.
   scoped_refptr<base::SequencedTaskRunner> task_runner_;
-  raw_ptr<LevelDB, DanglingUntriaged> db_ = nullptr;
+  raw_ptr<LevelDB, DanglingAcrossTasks> db_ = nullptr;
 
   // The identifier used when recording metrics to determine the source of the
   // LevelDB calls, likely the database client name.

components/metrics/metrics_state_manager.h

@@ -340,7 +340,7 @@ class MetricsStateManager final {
 
   // Weak pointer to an enabled state provider. Used to know whether the user
   // has consented to reporting, and if reporting should be done.
-  raw_ptr<EnabledStateProvider, DanglingUntriaged> enabled_state_provider_;
+  raw_ptr<EnabledStateProvider, DanglingAcrossTasks> enabled_state_provider_;
 
   // Specified options for controlling trial randomization.
   const EntropyParams entropy_params_;

components/omnibox/browser/location_bar_model_impl.h

@@ -53,7 +53,7 @@ class LocationBarModelImpl : public LocationBarModel {
   std::u16string GetFormattedURL(
       url_formatter::FormatUrlTypes format_types) const;
 
-  raw_ptr<LocationBarModelDelegate, DanglingUntriaged> delegate_;
+  raw_ptr<LocationBarModelDelegate, DanglingAcrossTasks> delegate_;
   const size_t max_url_display_chars_;
 };
 

components/omnibox/browser/shortcuts_backend.h

@@ -166,7 +166,7 @@ class ShortcutsBackend : public RefcountedKeyedService,
   // Deletes all of the shortcuts.
   bool DeleteAllShortcuts();
 
-  raw_ptr<TemplateURLService, DanglingUntriaged> template_url_service_;
+  raw_ptr<TemplateURLService, DanglingAcrossTasks> template_url_service_;
   std::unique_ptr<SearchTermsData> search_terms_data_;
 
   CurrentState current_state_;

components/optimization_guide/core/hints_manager.h

@@ -503,7 +503,7 @@ class HintsManager : public OptimizationHintsComponentObserver,
   raw_ptr<TopHostProvider, DanglingUntriaged> top_host_provider_ = nullptr;
 
   // The tab URL provider that can be queried. Not owned.
-  raw_ptr<TabUrlProvider, DanglingUntriaged> tab_url_provider_ = nullptr;
+  raw_ptr<TabUrlProvider, DanglingAcrossTasks> tab_url_provider_ = nullptr;
 
   // The timer used to schedule fetching hints from the remote Optimization
   // Guide Service.

components/password_manager/content/browser/content_password_manager_driver_factory.h

@@ -72,8 +72,8 @@ class ContentPasswordManagerDriverFactory
   std::map<content::RenderFrameHost*, ContentPasswordManagerDriver>
       frame_driver_map_;
 
-  raw_ptr<PasswordManagerClient, DanglingUntriaged> password_client_;
-  raw_ptr<autofill::AutofillClient, DanglingUntriaged> autofill_client_;
+  raw_ptr<PasswordManagerClient, DanglingAcrossTasks> password_client_;
+  raw_ptr<autofill::AutofillClient, DanglingAcrossTasks> autofill_client_;
 
   WEB_CONTENTS_USER_DATA_KEY_DECL();
 };

components/password_manager/core/browser/affiliation/affiliation_service_impl.h

@@ -129,7 +129,7 @@ class AffiliationServiceImpl : public AffiliationService,
   // living on the backend thread. It will be deleted asynchronously during
   // shutdown on the backend thread, so it will outlive |this| along with all
   // its in-flight tasks.
-  raw_ptr<AffiliationBackend, DanglingUntriaged> backend_;
+  raw_ptr<AffiliationBackend, DanglingAcrossTasks> backend_;
 
   raw_ptr<PrefService> pref_service_;
 

components/password_manager/core/browser/password_reuse_manager_impl.h

@@ -111,7 +111,7 @@ class PasswordReuseManagerImpl : public PasswordReuseManager,
   // living on the background thread. It will be deleted asynchronously during
   // shutdown on the background thread, so it will outlive |this| along with all
   // its in-flight tasks.
-  raw_ptr<PasswordReuseDetector, DanglingUntriaged> reuse_detector_ = nullptr;
+  raw_ptr<PasswordReuseDetector, DanglingAcrossTasks> reuse_detector_ = nullptr;
 
   // Notifies PasswordReuseManager about sign-in events.
   std::unique_ptr<PasswordStoreSigninNotifier> notifier_;

components/password_manager/core/browser/password_store.h

@@ -216,7 +216,7 @@ class PasswordStore : public PasswordStoreInterface {
 
   std::unique_ptr<AffiliatedMatchHelper> affiliated_match_helper_;
 
-  raw_ptr<PrefService, DanglingUntriaged> prefs_ = nullptr;
+  raw_ptr<PrefService, DanglingAcrossTasks> prefs_ = nullptr;
 
   InitStatus init_status_ = InitStatus::kUnknown;
 };

components/policy/core/common/cloud/cloud_policy_core.h

@@ -136,7 +136,7 @@ class POLICY_EXPORT CloudPolicyCore {
 
   std::string policy_type_;
   std::string settings_entity_id_;
-  raw_ptr<CloudPolicyStore, DanglingUntriaged> store_;
+  raw_ptr<CloudPolicyStore, DanglingAcrossTasks> store_;
   scoped_refptr<base::SequencedTaskRunner> task_runner_;
   network::NetworkConnectionTrackerGetter network_connection_tracker_getter_;
   std::unique_ptr<CloudPolicyClient> client_;

components/policy/core/common/policy_statistics_collector.h

@@ -80,7 +80,7 @@ class POLICY_EXPORT PolicyStatisticsCollector {
   GetChromePolicyDetailsCallback get_details_;
   Schema chrome_schema_;
   raw_ptr<PolicyService> policy_service_;
-  raw_ptr<PrefService, DanglingUntriaged> prefs_;
+  raw_ptr<PrefService, DanglingAcrossTasks> prefs_;
 
   base::CancelableOnceClosure update_callback_;
 

components/prefs/pref_change_registrar.h

@@ -74,7 +74,7 @@ class COMPONENTS_PREFS_EXPORT PrefChangeRegistrar final : public PrefObserver {
   using ObserverMap = std::map<std::string, NamedChangeCallback>;
 
   ObserverMap observers_;
-  raw_ptr<PrefService, DanglingUntriaged> service_;
+  raw_ptr<PrefService, DanglingAcrossTasks> service_;
 };
 
 #endif  // COMPONENTS_PREFS_PREF_CHANGE_REGISTRAR_H_

components/privacy_sandbox/privacy_sandbox_settings_impl.h

@@ -160,7 +160,8 @@ class PrivacySandboxSettingsImpl : public PrivacySandboxSettings {
   base::ObserverList<Observer>::Unchecked observers_;
 
   std::unique_ptr<Delegate> delegate_;
-  raw_ptr<HostContentSettingsMap, DanglingUntriaged> host_content_settings_map_;
+  raw_ptr<HostContentSettingsMap, DanglingAcrossTasks>
+      host_content_settings_map_;
   scoped_refptr<content_settings::CookieSettings> cookie_settings_;
   raw_ptr<PrefService, DanglingUntriaged> pref_service_;
   PrefChangeRegistrar pref_change_registrar_;

components/renderer_context_menu/context_menu_delegate.cc

@@ -21,7 +21,7 @@ class ContextMenuDelegateUserData : public base::SupportsUserData::Data {
   ContextMenuDelegate* menu_delegate() { return menu_delegate_; }
 
  private:
-  raw_ptr<ContextMenuDelegate, DanglingUntriaged>
+  raw_ptr<ContextMenuDelegate, DanglingAcrossTasks>
       menu_delegate_;  // not owned by us.
 };
 

components/segmentation_platform/embedder/default_model/device_switcher_result_dispatcher.h

@@ -66,7 +66,7 @@ class DeviceSwitcherResultDispatcher : public base::SupportsUserData::Data,
   const raw_ptr<SegmentationPlatformService> segmentation_service_;
   const raw_ptr<syncer::SyncService> sync_service_;
   const raw_ptr<PrefService> prefs_;
-  const raw_ptr<FieldTrialRegister, DanglingUntriaged> field_trial_register_;
+  const raw_ptr<FieldTrialRegister, DanglingAcrossTasks> field_trial_register_;
   ClassificationResultCallback waiting_callback_;
   absl::optional<ClassificationResult> latest_result_;
 

components/segmentation_platform/internal/selection/segment_result_provider.cc

@@ -75,7 +75,7 @@ class SegmentResultProviderImpl : public SegmentResultProvider {
  private:
   struct RequestState {
     std::unordered_map<DefaultModelManager::SegmentSource,
-                       raw_ptr<ModelProvider, DanglingUntriaged>>
+                       raw_ptr<ModelProvider, DanglingAcrossTasks>>
         model_providers;
     DefaultModelManager::SegmentInfoList available_segments;
     std::unique_ptr<GetResultOptions> options;

components/segmentation_platform/internal/signals/signal_filter_processor.h

@@ -55,7 +55,7 @@ class SignalFilterProcessor {
   const raw_ptr<StorageService, DanglingUntriaged> storage_service_;
   const raw_ptr<UserActionSignalHandler> user_action_signal_handler_;
   const raw_ptr<HistogramSignalHandler> histogram_signal_handler_;
-  const raw_ptr<HistoryServiceObserver, DanglingUntriaged> history_observer_;
+  const raw_ptr<HistoryServiceObserver, DanglingAcrossTasks> history_observer_;
   const base::flat_set<SegmentId> segment_ids_;
 
   base::WeakPtrFactory<SignalFilterProcessor> weak_ptr_factory_{this};

components/sessions/core/session_id_generator.h

@@ -56,7 +56,7 @@ class SESSIONS_EXPORT SessionIdGenerator {
   void IncrementValueBy(int increment);
 
   SEQUENCE_CHECKER(sequence_checker_);
-  raw_ptr<PrefService, DanglingUntriaged> local_state_;
+  raw_ptr<PrefService, DanglingAcrossTasks> local_state_;
   SessionID::id_type last_value_;
 
   // Used to override the random number generator for tests.

components/signin/internal/identity_manager/accounts_cookie_mutator_impl.h

@@ -86,10 +86,10 @@ class AccountsCookieMutatorImpl : public AccountsCookieMutator {
   };
 
   raw_ptr<SigninClient> signin_client_;
-  raw_ptr<ProfileOAuth2TokenService, DanglingUntriaged> token_service_;
-  raw_ptr<GaiaCookieManagerService, DanglingUntriaged>
+  raw_ptr<ProfileOAuth2TokenService, DanglingAcrossTasks> token_service_;
+  raw_ptr<GaiaCookieManagerService, DanglingAcrossTasks>
       gaia_cookie_manager_service_;
-  raw_ptr<AccountTrackerService, DanglingUntriaged> account_tracker_service_;
+  raw_ptr<AccountTrackerService, DanglingAcrossTasks> account_tracker_service_;
 };
 
 }  // namespace signin

components/signin/internal/identity_manager/accounts_mutator_impl.h

@@ -73,9 +73,9 @@ class AccountsMutatorImpl : public AccountsMutator {
 #endif
 
  private:
-  raw_ptr<ProfileOAuth2TokenService, DanglingUntriaged> token_service_;
-  raw_ptr<AccountTrackerService, DanglingUntriaged> account_tracker_service_;
-  raw_ptr<PrimaryAccountManager, DanglingUntriaged> primary_account_manager_;
+  raw_ptr<ProfileOAuth2TokenService, DanglingAcrossTasks> token_service_;
+  raw_ptr<AccountTrackerService, DanglingAcrossTasks> account_tracker_service_;
+  raw_ptr<PrimaryAccountManager, DanglingAcrossTasks> primary_account_manager_;
 #if BUILDFLAG(ENABLE_DICE_SUPPORT)
   raw_ptr<PrefService> pref_service_;
 #endif

components/signin/internal/identity_manager/diagnostics_provider_impl.h

@@ -38,9 +38,9 @@ class DiagnosticsProviderImpl final : public DiagnosticsProvider {
   base::TimeDelta GetDelayBeforeMakingCookieRequests() const override;
 
  private:
-  raw_ptr<GaiaCookieManagerService, DanglingUntriaged>
+  raw_ptr<GaiaCookieManagerService, DanglingAcrossTasks>
       gaia_cookie_manager_service_;
-  raw_ptr<ProfileOAuth2TokenService, DanglingUntriaged>
+  raw_ptr<ProfileOAuth2TokenService, DanglingAcrossTasks>
       profile_oauth2_token_service_;
 };
 

components/signin/internal/identity_manager/primary_account_mutator_impl.h

@@ -49,8 +49,9 @@ class PrimaryAccountMutatorImpl : public PrimaryAccountMutator {
 
   // Pointers to the services used by the PrimaryAccountMutatorImpl. They
   // *must* outlive this instance.
-  raw_ptr<AccountTrackerService, DanglingUntriaged> account_tracker_ = nullptr;
-  raw_ptr<PrimaryAccountManager, DanglingUntriaged> primary_account_manager_ =
+  raw_ptr<AccountTrackerService, DanglingAcrossTasks> account_tracker_ =
+      nullptr;
+  raw_ptr<PrimaryAccountManager, DanglingAcrossTasks> primary_account_manager_ =
       nullptr;
   raw_ptr<PrefService> pref_service_ = nullptr;
   raw_ptr<SigninClient> signin_client_ = nullptr;