DanglingPtr: Mark all of them as untriaged [1/N]

This patch must be a no-op with all the common build flags.

Add the "DanglingUntriaged" raw_ptr annotation. It indicates a
raw_ptr becomes dangling, and it should be triaged/fixed.

This annotates the one firing during content_browsertests.
Multiple follow-up will complete the list, up until being able to
enable dangling pointer detection on a bot.

Stats:
- 175 DanglingUntriaged in code
- 69 DanglingUntriaged in tests

Bug=1291138

Change-Id: I00771bd46403f90297aa5b972fdd1ddc23b18e07
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3687960
Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Bartek Nowierski <bartekn@chromium.org>
Owners-Override: Bartek Nowierski <bartekn@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1013525}

base/big_endian.h

@@ -137,8 +137,8 @@ class BASE_EXPORT BigEndianWriter {
   template<typename T>
   bool Write(T v);
 
-  raw_ptr<char> ptr_;
-  raw_ptr<char> end_;
+  raw_ptr<char, DanglingUntriaged> ptr_;
+  raw_ptr<char, DanglingUntriaged> end_;
 };
 
 }  // namespace base

base/bind_internal.h

@@ -94,8 +94,9 @@ class UnretainedWrapper {
   T* get() const { return ptr_; }
 
  private:
-  using ImplType = std::
-      conditional_t<raw_ptr_traits::IsSupportedType<T>::value, raw_ptr<T>, T*>;
+  using ImplType = std::conditional_t<raw_ptr_traits::IsSupportedType<T>::value,
+                                      raw_ptr<T, DanglingUntriaged>,
+                                      T*>;
   ImplType ptr_;
 };
 
@@ -114,8 +115,9 @@ class UnretainedRefWrapper {
   T& get() const { return *ptr_; }
 
  private:
-  using ImplType = std::
-      conditional_t<raw_ptr_traits::IsSupportedType<T>::value, raw_ptr<T>, T*>;
+  using ImplType = std::conditional_t<raw_ptr_traits::IsSupportedType<T>::value,
+                                      raw_ptr<T, DanglingUntriaged>,
+                                      T*>;
   ImplType const ptr_;
 };
 

base/containers/enum_set.h

@@ -148,7 +148,7 @@ class EnumSet {
       return i;
     }
 
-    raw_ptr<const EnumBitSet> enums_;
+    raw_ptr<const EnumBitSet, DanglingUntriaged> enums_;
     size_t i_;
   };
 

base/files/file_descriptor_watcher_posix.h

@@ -75,7 +75,7 @@ class BASE_EXPORT FileDescriptorWatcher {
     // Controller is deleted, ownership of |watcher_| is transfered to a delete
     // task posted to the MessageLoopForIO. This ensures that |watcher_| isn't
     // deleted while it is being used by the MessageLoopForIO.
-    raw_ptr<Watcher> watcher_;
+    raw_ptr<Watcher, DanglingUntriaged> watcher_;
 
     // An event for the watcher to notify controller that it's destroyed.
     // As the |watcher_| is owned by Controller, always outlives the Watcher.

base/message_loop/message_pump_libevent.h

@@ -116,14 +116,14 @@ class BASE_EXPORT MessagePumpLibevent : public MessagePump,
 
   // Libevent dispatcher.  Watches all sockets registered with it, and sends
   // readiness callbacks when a socket is ready for I/O.
-  const raw_ptr<event_base> event_base_;
+  const raw_ptr<event_base, DanglingUntriaged> event_base_;
 
   // ... write end; ScheduleWork() writes a single byte to it
   int wakeup_pipe_in_ = -1;
   // ... read end; OnWakeup reads it and then breaks Run() out of its sleep
   int wakeup_pipe_out_ = -1;
   // ... libevent wrapper for read end
-  raw_ptr<event> wakeup_event_ = nullptr;
+  raw_ptr<event, DanglingUntriaged> wakeup_event_ = nullptr;
 
   ThreadChecker watch_file_descriptor_caller_checker_;
 };

base/metrics/field_trial.h

@@ -125,8 +125,8 @@ class BASE_EXPORT FieldTrial : public RefCounted<FieldTrial> {
   // FieldTrial object. Does not use StringPiece to avoid conversions back to
   // std::string.
   struct BASE_EXPORT State {
-    raw_ptr<const std::string> trial_name = nullptr;
-    raw_ptr<const std::string> group_name = nullptr;
+    raw_ptr<const std::string, DanglingUntriaged> trial_name = nullptr;
+    raw_ptr<const std::string, DanglingUntriaged> group_name = nullptr;
     bool activated = false;
 
     State();

base/process/process_iterator.h

@@ -118,7 +118,7 @@ class BASE_EXPORT ProcessIterator {
   std::vector<kinfo_proc> kinfo_procs_;
   size_t index_of_kinfo_proc_;
 #elif BUILDFLAG(IS_POSIX) || BUILDFLAG(IS_FUCHSIA)
-  raw_ptr<DIR> procfs_dir_;
+  raw_ptr<DIR, DanglingUntriaged> procfs_dir_;
 #endif
   ProcessEntry entry_;
   raw_ptr<const ProcessFilter> filter_;

base/synchronization/waitable_event_watcher.h

@@ -145,7 +145,7 @@ class BASE_EXPORT WaitableEventWatcher
   scoped_refptr<Flag> cancel_flag_;
 
   // Enqueued in the wait list of the watched WaitableEvent.
-  raw_ptr<AsyncWaiter> waiter_ = nullptr;
+  raw_ptr<AsyncWaiter, DanglingUntriaged> waiter_ = nullptr;
 
   // Kernel of the watched WaitableEvent.
   scoped_refptr<WaitableEvent::WaitableEventKernel> kernel_;

base/task/sequence_manager/atomic_flag_set.h

@@ -67,8 +67,9 @@ class BASE_EXPORT AtomicFlagSet {
 
     AtomicFlag(AtomicFlagSet* outer, Group* element, size_t flag_bit);
 
-    raw_ptr<AtomicFlagSet> outer_ = nullptr;
-    raw_ptr<Group> group_ = nullptr;  // Null when AtomicFlag is invalid.
+    raw_ptr<AtomicFlagSet, DanglingUntriaged> outer_ = nullptr;
+    raw_ptr<Group, DanglingUntriaged> group_ =
+        nullptr;           // Null when AtomicFlag is invalid.
     size_t flag_bit_ = 0;  // This is 1 << index of this flag within the group.
   };
 

base/task/sequence_manager/task_queue_impl.h

@@ -330,7 +330,7 @@ class BASE_EXPORT TaskQueueImpl {
 
     base::internal::OperationsController operations_controller_;
     // Pointer might be stale, access guarded by |operations_controller_|
-    const raw_ptr<TaskQueueImpl> outer_;
+    const raw_ptr<TaskQueueImpl, DanglingUntriaged> outer_;
   };
 
   class TaskRunner final : public SingleThreadTaskRunner {

base/threading/sequence_bound.h

@@ -445,7 +445,8 @@ class SequenceBound {
     //   destructor will `CHECK()` if `sequence_bound_` is non-null, since that
     //   indicates `Then()` was not invoked. Similarly, note this branch should
     //   be eliminated by the optimizer if the code is free of bugs. :)
-    raw_ptr<const SequenceBound<T, CrossThreadBindTraits>> sequence_bound_;
+    raw_ptr<const SequenceBound<T, CrossThreadBindTraits>, DanglingUntriaged>
+        sequence_bound_;
     // Subtle: this typically points at a Location *temporary*. This is used to
     // try to detect errors resulting from lifetime extension of the async call
     // factory temporaries, since the factory destructors can perform work. If

base/trace_event/memory_dump_provider_info.h

@@ -67,7 +67,7 @@ struct BASE_EXPORT MemoryDumpProviderInfo
   // It is safe to access the const fields below from any thread as they are
   // never mutated.
 
-  const raw_ptr<MemoryDumpProvider> dump_provider;
+  const raw_ptr<MemoryDumpProvider, DanglingUntriaged> dump_provider;
 
   // The |options| arg passed to MDM::RegisterDumpProvider().
   const MemoryDumpProvider::Options options;

cc/base/rtree.h

@@ -106,7 +106,7 @@ class RTree {
     // valid index pointing to an element in the vector that was used to build
     // this rtree. When the level is not 0, it's an internal node and it has a
     // valid subtree pointer.
-    raw_ptr<Node<U>> subtree;
+    raw_ptr<Node<U>, DanglingUntriaged> subtree;
     U payload;
 
     gfx::Rect bounds;

cc/input/threaded_input_handler.h

@@ -367,7 +367,8 @@ class CC_EXPORT ThreadedInputHandler : public InputHandler,
   // together.
   CompositorDelegateForInput& compositor_delegate_;
 
-  raw_ptr<InputHandlerClient> input_handler_client_ = nullptr;
+  raw_ptr<InputHandlerClient, DanglingUntriaged> input_handler_client_ =
+      nullptr;
 
   // An object to implement the ScrollElasticityHelper interface and
   // hold all state related to elasticity. May be nullptr if never requested.

cc/metrics/frame_sequence_tracker_collection.h

@@ -169,7 +169,7 @@ class CC_EXPORT FrameSequenceTrackerCollection {
   NotifyCustomerTrackerResutlsCallback custom_tracker_results_added_callback_;
 
   std::vector<std::unique_ptr<FrameSequenceTracker>> removal_trackers_;
-  const raw_ptr<CompositorFrameReportingController>
+  const raw_ptr<CompositorFrameReportingController, DanglingUntriaged>
       compositor_frame_reporting_controller_;
 
   base::flat_map<

cc/mojo_embedder/async_layer_tree_frame_sink.h

@@ -134,7 +134,8 @@ class CC_MOJO_EMBEDDER_EXPORT AsyncLayerTreeFrameSink
   // One of |compositor_frame_sink_| or |compositor_frame_sink_associated_| will
   // be bound after calling BindToClient(). |compositor_frame_sink_ptr_| will
   // point to message pipe we want to use.
-  raw_ptr<viz::mojom::CompositorFrameSink> compositor_frame_sink_ptr_ = nullptr;
+  raw_ptr<viz::mojom::CompositorFrameSink, DanglingUntriaged>
+      compositor_frame_sink_ptr_ = nullptr;
   mojo::Remote<viz::mojom::CompositorFrameSink> compositor_frame_sink_;
   mojo::AssociatedRemote<viz::mojom::CompositorFrameSink>
       compositor_frame_sink_associated_;

cc/scheduler/scheduler.h

@@ -296,7 +296,7 @@ class CC_EXPORT Scheduler : public viz::BeginFrameObserverBase {
 
   // Owned by LayerTreeHostImpl and is destroyed when LayerTreeHostImpl is
   // destroyed.
-  raw_ptr<CompositorFrameReportingController>
+  raw_ptr<CompositorFrameReportingController, DanglingUntriaged>
       compositor_frame_reporting_controller_;
 
   // What the latest deadline was, and when it was scheduled.

cc/tiles/tile_manager.cc

@@ -176,7 +176,7 @@ class RasterTaskImpl : public TileTask {
   TileResolution tile_resolution_;
   int layer_id_;
   uint64_t source_prepare_tiles_id_;
-  raw_ptr<void> tile_tracing_id_;
+  raw_ptr<void, DanglingUntriaged> tile_tracing_id_;
   uint64_t new_content_id_;
   int source_frame_number_;
   std::unique_ptr<RasterBuffer> raster_buffer_;
@@ -368,7 +368,7 @@ class DidFinishRunningAllTilesTask : public TileTask {
 
  private:
   raw_ptr<base::SequencedTaskRunner> task_runner_;
-  raw_ptr<RasterQueryQueue> pending_raster_queries_;
+  raw_ptr<RasterQueryQueue, DanglingUntriaged> pending_raster_queries_;
   CompletionCb completion_cb_;
 };
 

cc/tiles/tile_manager.h

@@ -441,17 +441,18 @@ class CC_EXPORT TileManager : CheckerImageTrackerClient {
 
   bool ShouldRasterOccludedTiles() const;
 
-  raw_ptr<TileManagerClient> client_;
+  raw_ptr<TileManagerClient, DanglingUntriaged> client_;
   raw_ptr<base::SequencedTaskRunner> task_runner_;
-  raw_ptr<ResourcePool> resource_pool_;
+  raw_ptr<ResourcePool, DanglingUntriaged> resource_pool_;
   std::unique_ptr<TileTaskManager> tile_task_manager_;
-  raw_ptr<RasterBufferProvider> raster_buffer_provider_;
+  raw_ptr<RasterBufferProvider, DanglingUntriaged> raster_buffer_provider_;
   GlobalStateThatImpactsTilePriority global_state_;
   size_t scheduled_raster_task_limit_;
 
   const TileManagerSettings tile_manager_settings_;
   bool use_gpu_rasterization_;
-  raw_ptr<RasterQueryQueue> pending_raster_queries_ = nullptr;
+  raw_ptr<RasterQueryQueue, DanglingUntriaged> pending_raster_queries_ =
+      nullptr;
 
   std::unordered_map<Tile::Id, Tile*> tiles_;
 

components/cbor/reader.h

@@ -95,7 +95,7 @@ class CBOR_EXPORT Reader {
 
     // Used to report the specific error in the case that parsing fails. May be
     // nullptr;
-    raw_ptr<DecoderError> error_code_out = nullptr;
+    raw_ptr<DecoderError, DanglingUntriaged> error_code_out = nullptr;
 
     // Controls the maximum depth of CBOR nesting that will be permitted. This
     // exists to control stack consumption during parsing.

components/performance_manager/performance_manager_tab_helper.h

@@ -197,7 +197,7 @@ class PerformanceManagerTabHelper
   base::flat_set<std::unique_ptr<PageData>, PageDataComparator> pages_;
 
   // Tracks the primary page associated with this WebContents.
-  raw_ptr<PageData> primary_page_ = nullptr;
+  raw_ptr<PageData, DanglingUntriaged> primary_page_ = nullptr;
 
   // Maps from RenderFrameHost to the associated PM node. This is a single
   // map across all pages associated with this WebContents.

components/performance_manager/v8_memory/v8_context_tracker.h

@@ -97,7 +97,8 @@ class V8ContextTracker final
     // A pointer to the upstream ExecutionContextState that this V8Context is
     // associated with. Note that this can be nullptr for V8Contexts that are
     // not associated with an ExecutionContext.
-    const raw_ptr<ExecutionContextState> execution_context_state;
+    const raw_ptr<ExecutionContextState, DanglingUntriaged>
+        execution_context_state;
 
     // Whether or not this context is detached. A context becomes detached
     // when the blink::ExecutionContext it was associated with is torn down.

components/performance_manager/v8_memory/v8_context_tracker_internal.h

@@ -118,7 +118,7 @@ class ExecutionContextData : public base::LinkNode<ExecutionContextData>,
  private:
   const raw_ptr<ProcessData> process_data_;
 
-  raw_ptr<RemoteFrameData> remote_frame_data_ = nullptr;
+  raw_ptr<RemoteFrameData, DanglingUntriaged> remote_frame_data_ = nullptr;
 
   // The count of V8ContextDatas keeping this object alive.
   size_t v8_context_count_ = 0;
@@ -166,7 +166,8 @@ class RemoteFrameData : public base::LinkNode<RemoteFrameData> {
  private:
   const raw_ptr<ProcessData> process_data_;
   const blink::RemoteFrameToken token_;
-  const raw_ptr<ExecutionContextData> execution_context_data_;
+  const raw_ptr<ExecutionContextData, DanglingUntriaged>
+      execution_context_data_;
 };
 
 ////////////////////////////////////////////////////////////////////////////////

components/services/storage/dom_storage/local_storage_impl.cc

@@ -231,7 +231,7 @@ class LocalStorageImpl::StorageAreaHolder final
   // during destruction of the StorageAreaImpl instance we might still get
   // called and need access  to the StorageAreaImpl instance. The unique_ptr
   // could already be null, but this field should still be valid.
-  raw_ptr<StorageAreaImpl> area_ptr_;
+  raw_ptr<StorageAreaImpl, DanglingUntriaged> area_ptr_;
   std::unique_ptr<StorageAreaImpl> area_;
   bool has_bindings_ = false;
 };

components/services/storage/indexed_db/scopes/leveldb_scope.h

@@ -125,7 +125,7 @@ class LevelDBScope {
     // The ranges are expected to be disjoint.
     bool operator()(const EmptyRange& lhs, const EmptyRange& rhs) const;
 
-    raw_ptr<const leveldb::Comparator> comparator_ = nullptr;
+    raw_ptr<const leveldb::Comparator, DanglingUntriaged> comparator_ = nullptr;
   };
 
   enum class Mode { kInMemory, kUndoLogOnDisk };

components/services/storage/indexed_db/transactional_leveldb/transactional_leveldb_database.h

@@ -50,8 +50,8 @@ class LevelDBSnapshot {
   const leveldb::Snapshot* snapshot() const { return snapshot_; }
 
  private:
-  raw_ptr<leveldb::DB> db_;
-  raw_ptr<const leveldb::Snapshot> snapshot_;
+  raw_ptr<leveldb::DB, DanglingUntriaged> db_;
+  raw_ptr<const leveldb::Snapshot, DanglingUntriaged> snapshot_;
 };
 
 class TransactionalLevelDBDatabase

components/viz/host/host_frame_sink_manager.h

@@ -298,7 +298,8 @@ class VIZ_HOST_EXPORT HostFrameSinkManager
   // This will point to |frame_sink_manager_remote_| if using mojo or it may
   // point directly at FrameSinkManagerImpl in tests. Use this to make function
   // calls.
-  raw_ptr<mojom::FrameSinkManager> frame_sink_manager_ = nullptr;
+  raw_ptr<mojom::FrameSinkManager, DanglingUntriaged> frame_sink_manager_ =
+      nullptr;
 
   // Connections to/from FrameSinkManagerImpl.
   mojo::Remote<mojom::FrameSinkManager> frame_sink_manager_remote_;

components/viz/service/display/direct_renderer.h

@@ -118,9 +118,10 @@ class VIZ_SERVICE_EXPORT DirectRenderer {
     DrawingFrame();
     ~DrawingFrame();
 
-    raw_ptr<const AggregatedRenderPassList> render_passes_in_draw_order =
+    raw_ptr<const AggregatedRenderPassList, DanglingUntriaged>
+        render_passes_in_draw_order = nullptr;
+    raw_ptr<const AggregatedRenderPass, DanglingUntriaged> root_render_pass =
         nullptr;
-    raw_ptr<const AggregatedRenderPass> root_render_pass = nullptr;
     const AggregatedRenderPass* current_render_pass = nullptr;
 
     gfx::Rect root_damage_rect;
@@ -301,11 +302,11 @@ class VIZ_SERVICE_EXPORT DirectRenderer {
   // Points to the viz-global singleton.
   const raw_ptr<const DebugRendererSettings> debug_settings_;
   const raw_ptr<OutputSurface> output_surface_;
-  const raw_ptr<DisplayResourceProvider> resource_provider_;
+  const raw_ptr<DisplayResourceProvider, DanglingUntriaged> resource_provider_;
   // This can be replaced by test implementations.
   // TODO(weiliangc): For SoftwareRenderer and tests where overlay is not used,
   // use OverlayProcessorStub so this pointer is never null.
-  raw_ptr<OverlayProcessorInterface> overlay_processor_;
+  raw_ptr<OverlayProcessorInterface, DanglingUntriaged> overlay_processor_;
 
   // Whether it's valid to SwapBuffers with an empty rect. Trivially true when
   // using partial swap.

components/viz/service/display/display_damage_tracker.h

@@ -106,8 +106,8 @@ class VIZ_SERVICE_EXPORT DisplayDamageTracker : public SurfaceObserver {
   void NotifyPendingSurfacesChanged();
 
   base::ObserverList<Observer>::Unchecked observers_;
-  const raw_ptr<SurfaceManager> surface_manager_;
-  const raw_ptr<SurfaceAggregator> aggregator_;
+  const raw_ptr<SurfaceManager, DanglingUntriaged> surface_manager_;
+  const raw_ptr<SurfaceAggregator, DanglingUntriaged> aggregator_;
 
   bool root_frame_missing_ = true;
 

components/viz/service/display/resolved_frame_data.h

@@ -41,7 +41,7 @@ struct VIZ_SERVICE_EXPORT FixedPassData {
   FixedPassData& operator=(FixedPassData&& other);
   ~FixedPassData();
 
-  raw_ptr<CompositorRenderPass> render_pass = nullptr;
+  raw_ptr<CompositorRenderPass, DanglingUntriaged> render_pass = nullptr;
   // DrawQuads in |render_pass| that can contribute additional damage (eg.
   // surface and render passes) that need to be visited during the prewalk phase
   // of aggregation. Stored in front-to-back order like in |render_pass|.

components/viz/service/display/skia_renderer.cc

@@ -587,7 +587,7 @@ class SkiaRenderer::ScopedSkImageBuilder {
   const absl::optional<SkColor4f>& clear_color() const { return clear_color_; }
 
  private:
-  raw_ptr<const SkImage> sk_image_ = nullptr;
+  raw_ptr<const SkImage, DanglingUntriaged> sk_image_ = nullptr;
   raw_ptr<const cc::PaintOpBuffer> paint_op_buffer_ = nullptr;
   absl::optional<SkColor4f> clear_color_;
 };

components/viz/service/display/skia_renderer.h

@@ -290,9 +290,9 @@ class VIZ_SERVICE_EXPORT SkiaRenderer : public DirectRenderer {
 
   // Interface used for drawing. Common among different draw modes.
   sk_sp<SkSurface> root_surface_;
-  raw_ptr<SkCanvas> root_canvas_ = nullptr;
-  raw_ptr<SkCanvas> current_canvas_ = nullptr;
-  raw_ptr<SkSurface> current_surface_ = nullptr;
+  raw_ptr<SkCanvas, DanglingUntriaged> root_canvas_ = nullptr;
+  raw_ptr<SkCanvas, DanglingUntriaged> current_canvas_ = nullptr;
+  raw_ptr<SkSurface, DanglingUntriaged> current_surface_ = nullptr;
 
   class FrameResourceGpuCommandsCompletedFence;
   scoped_refptr<FrameResourceGpuCommandsCompletedFence>
@@ -327,7 +327,7 @@ class VIZ_SERVICE_EXPORT SkiaRenderer : public DirectRenderer {
   std::vector<SkMatrix> batched_cdt_matrices_;
 
   // Specific for SkDDL.
-  const raw_ptr<SkiaOutputSurface> skia_output_surface_;
+  const raw_ptr<SkiaOutputSurface, DanglingUntriaged> skia_output_surface_;
 
   const bool is_using_raw_draw_;
 

components/viz/service/frame_sinks/frame_sink_manager_impl.h

@@ -428,7 +428,7 @@ class VIZ_SERVICE_EXPORT FrameSinkManagerImpl
   //     remote client and |ui_task_runner_| will be nullptr, and calls to
   //     OnFrameTokenChanged() will be directly called (without PostTask) on
   //     |client_|. Used for some unit tests.
-  raw_ptr<mojom::FrameSinkManagerClient> client_ = nullptr;
+  raw_ptr<mojom::FrameSinkManagerClient, DanglingUntriaged> client_ = nullptr;
   scoped_refptr<base::SingleThreadTaskRunner> ui_task_runner_;
   mojo::Remote<mojom::FrameSinkManagerClient> client_remote_;
   mojo::Receiver<mojom::FrameSinkManager> receiver_{this};

components/viz/service/frame_sinks/gmb_video_frame_pool_context_provider_impl.h

@@ -35,7 +35,8 @@ class VIZ_SERVICE_EXPORT GmbVideoFramePoolContextProviderImpl
 
  private:
   const raw_ptr<GpuServiceImpl> gpu_service_;
-  const raw_ptr<InProcessGpuMemoryBufferManager> gpu_memory_buffer_manager_;
+  const raw_ptr<InProcessGpuMemoryBufferManager, DanglingUntriaged>
+      gpu_memory_buffer_manager_;
 };
 
 }  // namespace viz

components/viz/service/hit_test/hit_test_aggregator.h

@@ -80,7 +80,7 @@ class VIZ_SERVICE_EXPORT HitTestAggregator {
 
   const raw_ptr<HitTestAggregatorDelegate> delegate_;
 
-  const raw_ptr<LatestLocalSurfaceIdLookupDelegate>
+  const raw_ptr<LatestLocalSurfaceIdLookupDelegate, DanglingUntriaged>
       local_surface_id_lookup_delegate_;
 
   // This is the FrameSinkId for the corresponding root CompositorFrameSink.

components/viz/test/gpu_host_impl_test_api.h

@@ -27,7 +27,7 @@ class GpuHostImplTestApi {
   void SetGpuService(mojo::Remote<mojom::GpuService> gpu_service);
 
  private:
-  raw_ptr<GpuHostImpl> gpu_host_;
+  raw_ptr<GpuHostImpl, DanglingUntriaged> gpu_host_;
 };
 
 }  // namespace viz

components/viz/test/host_frame_sink_manager_test_api.h

@@ -35,7 +35,7 @@ class HostFrameSinkManagerTestApi {
 
  private:
   // Not owned.
-  raw_ptr<HostFrameSinkManager> host_frame_sink_manager_;
+  raw_ptr<HostFrameSinkManager, DanglingUntriaged> host_frame_sink_manager_;
 };
 
 }  // namespace viz

content/browser/accessibility/browser_accessibility.h

@@ -614,7 +614,7 @@ class CONTENT_EXPORT BrowserAccessibility : public ui::AXPlatformNodeDelegate {
   // The underlying node. This could change during the lifetime of this object
   // if this object has been reparented, i.e. moved to another part of the tree.
   // Weak, `AXTree` owns this.
-  raw_ptr<ui::AXNode> node_;
+  raw_ptr<ui::AXNode, DanglingUntriaged> node_;
 
   // Protected so that it can't be called directly on a BrowserAccessibility
   // where it could be confused with an id that comes from the node data,

content/browser/accessibility/touch_passthrough_manager.h

@@ -91,7 +91,7 @@ class CONTENT_EXPORT TouchPassthroughManager {
 
   // Classes needed to generate touch events.
   std::unique_ptr<SyntheticGestureController> gesture_controller_;
-  raw_ptr<SyntheticGestureTarget> gesture_target_ = nullptr;
+  raw_ptr<SyntheticGestureTarget, DanglingUntriaged> gesture_target_ = nullptr;
   std::unique_ptr<SyntheticTouchDriver> touch_driver_;
 
   // Keeps track of whether or not touch is down, regardless of whether or

content/browser/attribution_reporting/attribution_internals_browsertest.cc

@@ -147,7 +147,7 @@ class AttributionInternalsWebUiBrowserTest : public ContentBrowserTest {
   MockAttributionManager* manager() { return manager_; }
 
  private:
-  raw_ptr<MockAttributionManager> manager_;
+  raw_ptr<MockAttributionManager, DanglingUntriaged> manager_;
 };
 
 IN_PROC_BROWSER_TEST_F(AttributionInternalsWebUiBrowserTest,

content/browser/attribution_reporting/attribution_src_browsertest.cc

@@ -109,7 +109,7 @@ class AttributionSrcBrowserTest : public ContentBrowserTest {
 
  private:
   std::unique_ptr<net::EmbeddedTestServer> https_server_;
-  base::raw_ptr<MockAttributionHost> mock_attribution_host_;
+  base::raw_ptr<MockAttributionHost, DanglingUntriaged> mock_attribution_host_;
 };
 
 IN_PROC_BROWSER_TEST_F(AttributionSrcBrowserTest, SourceRegistered) {

content/browser/attribution_reporting/rate_limit_table.h

@@ -122,7 +122,7 @@ class CONTENT_EXPORT RateLimitTable {
       VALID_CONTEXT_REQUIRED(sequence_checker_);
 
   // Must outlive |this|.
-  raw_ptr<const AttributionStorageDelegate> delegate_
+  raw_ptr<const AttributionStorageDelegate, DanglingUntriaged> delegate_
       GUARDED_BY_CONTEXT(sequence_checker_);
 
   // Time at which `DeleteExpiredRateLimits()` was last called. Initialized to

content/browser/attribution_reporting/trigger_registration_browsertest.cc

@@ -73,7 +73,7 @@ class AttributionTriggerRegistrationBrowserTest : public ContentBrowserTest {
 
  private:
   std::unique_ptr<net::EmbeddedTestServer> https_server_;
-  base::raw_ptr<MockAttributionHost> mock_attribution_host_;
+  base::raw_ptr<MockAttributionHost, DanglingUntriaged> mock_attribution_host_;
 };
 
 IN_PROC_BROWSER_TEST_F(AttributionTriggerRegistrationBrowserTest,

content/browser/back_forward_cache_browsertest.h

@@ -318,7 +318,7 @@ class PageLifecycleStateManagerTestDelegate
       const blink::mojom::PageLifecycleState& new_state) override;
   void OnDeleted() override;
 
-  raw_ptr<PageLifecycleStateManager> manager_;
+  raw_ptr<PageLifecycleStateManager, DanglingUntriaged> manager_;
   base::OnceClosure store_in_back_forward_cache_sent_;
   base::OnceClosure store_in_back_forward_cache_ack_received_;
   base::OnceClosure restore_from_back_forward_cache_sent_;

content/browser/back_forward_cache_internal_browsertest.cc

@@ -2821,7 +2821,7 @@ class RenderViewHostDeletedObserver : public WebContentsObserver {
   bool deleted() const { return deleted_; }
 
  private:
-  raw_ptr<RenderViewHost> render_view_host_;
+  raw_ptr<RenderViewHost, DanglingUntriaged> render_view_host_;
   bool deleted_;
 };
 

content/browser/browser_interface_broker_impl.h

@@ -102,7 +102,7 @@ class BrowserInterfaceBrokerImpl : public blink::mojom::BrowserInterfaceBroker {
   // The lifetime of `policy_applier_` is managed by the owner of this instance.
   // The owner should call `ReleaseMojoBinderPolicies()` when it destroys the
   // applier.
-  raw_ptr<MojoBinderPolicyApplier> policy_applier_ = nullptr;
+  raw_ptr<MojoBinderPolicyApplier, DanglingUntriaged> policy_applier_ = nullptr;
 };
 
 }  // namespace content

content/browser/browsing_data/browsing_data_remover_impl_browsertest.cc

@@ -403,7 +403,7 @@ class TrustTokensTester {
   }
 
  private:
-  raw_ptr<network::mojom::NetworkContext> network_context_;
+  raw_ptr<network::mojom::NetworkContext, DanglingUntriaged> network_context_;
 };
 
 }  // namespace

content/browser/child_process_security_policy_impl.cc

@@ -651,7 +651,7 @@ class ChildProcessSecurityPolicyImpl::SecurityState {
   FileSystemMap filesystem_permissions_;
 
   raw_ptr<BrowserContext> browser_context_;
-  raw_ptr<ResourceContext> resource_context_;
+  raw_ptr<ResourceContext, DanglingUntriaged> resource_context_;
 };
 
 // IsolatedOriginEntry implementation.

content/browser/child_process_security_policy_impl.h

@@ -667,8 +667,8 @@ class CONTENT_EXPORT ChildProcessSecurityPolicyImpl
     // applies.  |browser_context_| may be used on the UI thread, and
     // |resource_context_| may be used on the IO thread.  If these are null,
     // then the isolated origin applies globally to all profiles.
-    raw_ptr<BrowserContext> browser_context_;
-    raw_ptr<ResourceContext> resource_context_;
+    raw_ptr<BrowserContext, DanglingUntriaged> browser_context_;
+    raw_ptr<ResourceContext, DanglingUntriaged> resource_context_;
 
     // True if origins at this or lower level should be treated as distinct
     // isolated origins, effectively isolating all domains below a given domain,

content/browser/content_index/content_index_browsertest.cc

@@ -85,9 +85,9 @@ class ContentIndexTest : public ContentBrowserTest {
 
  private:
   std::unique_ptr<net::EmbeddedTestServer> https_server_;
-  raw_ptr<ShellContentIndexProvider> provider_;
-  raw_ptr<ContentIndexContext> context_;
-  raw_ptr<Shell> shell_;
+  raw_ptr<ShellContentIndexProvider, DanglingUntriaged> provider_;
+  raw_ptr<ContentIndexContext, DanglingUntriaged> context_;
+  raw_ptr<Shell, DanglingUntriaged> shell_;
 };
 
 IN_PROC_BROWSER_TEST_F(ContentIndexTest, GetIcons) {

content/browser/download/download_browsertest.cc

@@ -602,7 +602,7 @@ class ErrorInjectionDownloadFileFactory : public download::DownloadFileFactory {
     download_file_ = nullptr;
   }
 
-  raw_ptr<ErrorInjectionDownloadFile> download_file_;
+  raw_ptr<ErrorInjectionDownloadFile, DanglingUntriaged> download_file_;
   int64_t injected_error_offset_ = -1;
   int64_t injected_error_length_ = 0;
   base::WeakPtrFactory<ErrorInjectionDownloadFileFactory> weak_ptr_factory_{

content/browser/fenced_frame/fenced_frame.h

@@ -111,7 +111,8 @@ class CONTENT_EXPORT FencedFrame : public blink::mojom::FencedFrameOwnerHost,
   // `owner_render_frame_host_` is associated with). It is set in the
   // constructor. Initially null, and only set in the constructor (indirectly
   // via `CreateProxyAndAttachToOuterFrameTree()`).
-  raw_ptr<RenderFrameProxyHost> proxy_to_inner_main_frame_ = nullptr;
+  raw_ptr<RenderFrameProxyHost, DanglingUntriaged> proxy_to_inner_main_frame_ =
+      nullptr;
 
   // The FrameTree that we create to host the "inner" fenced frame contents.
   std::unique_ptr<FrameTree> frame_tree_;

content/browser/file_system/file_system_browsertest.cc

@@ -65,7 +65,7 @@ class FileSystemBrowserTest : public ContentBrowserTest,
 
  protected:
   bool is_incognito_;
-  raw_ptr<Shell> browser_ = nullptr;
+  raw_ptr<Shell, DanglingUntriaged> browser_ = nullptr;
 };
 
 INSTANTIATE_TEST_SUITE_P(All, FileSystemBrowserTest, ::testing::Bool());

content/browser/file_system/file_system_url_loader_factory_browsertest.cc

@@ -506,7 +506,7 @@ class FileSystemURLLoaderFactoryTest
   scoped_refptr<storage::MockQuotaManager> quota_manager_;
   scoped_refptr<storage::MockQuotaManagerProxy> quota_manager_proxy_;
   // Owned by `file_system_context_` and only usable on `blocking_task_runner_`.
-  raw_ptr<storage::FileSystemFileUtil> file_util_ = nullptr;
+  raw_ptr<storage::FileSystemFileUtil, DanglingUntriaged> file_util_ = nullptr;
 };
 
 INSTANTIATE_TEST_SUITE_P(All,

content/browser/find_request_manager_browsertest.cc

@@ -160,7 +160,7 @@ class FindRequestManagerTestBase : public ContentBrowserTest {
   }
 
   FindTestWebContentsDelegate test_delegate_;
-  raw_ptr<WebContentsDelegate> normal_delegate_;
+  raw_ptr<WebContentsDelegate, DanglingUntriaged> normal_delegate_;
 
   // The ID of the last find request requested.
   int last_request_id_;

content/browser/gpu/gpu_ipc_browsertests.cc

@@ -82,8 +82,8 @@ class ContextTestBase : public content::ContentBrowserTest {
   }
 
  protected:
-  raw_ptr<gpu::gles2::GLES2Interface> gl_ = nullptr;
-  raw_ptr<gpu::ContextSupport> context_support_ = nullptr;
+  raw_ptr<gpu::gles2::GLES2Interface, DanglingUntriaged> gl_ = nullptr;
+  raw_ptr<gpu::ContextSupport, DanglingUntriaged> context_support_ = nullptr;
 
  private:
   scoped_refptr<viz::ContextProviderCommandBuffer> provider_;

content/browser/interest_group/auction_runner.h

@@ -324,18 +324,18 @@ class CONTENT_EXPORT AuctionRunner {
 
     // InterestGroup that made the bid. Owned by the BidState of that
     // InterestGroup.
-    const raw_ptr<const blink::InterestGroup> interest_group;
+    const raw_ptr<const blink::InterestGroup, DanglingUntriaged> interest_group;
 
     // Points to the InterestGroupAd within `interest_group`.
-    const raw_ptr<const blink::InterestGroup::Ad> bid_ad;
+    const raw_ptr<const blink::InterestGroup::Ad, DanglingUntriaged> bid_ad;
 
     // `bid_state` of the InterestGroup that made the bid. This should not be
     // written to, except for adding seller debug reporting URLs.
-    const raw_ptr<BidState> bid_state;
+    const raw_ptr<BidState, DanglingUntriaged> bid_state;
 
     // The Auction with the interest group that made this bid. Important in the
     // case of component auctions.
-    const raw_ptr<Auction> auction;
+    const raw_ptr<Auction, DanglingUntriaged> auction;
   };
 
   // Combines a Bid with seller score and seller state needed to invoke its

content/browser/interest_group/interest_group_browsertest.cc

@@ -933,9 +933,9 @@ class InterestGroupBrowserTest : public ContentBrowserTest {
   std::unique_ptr<net::EmbeddedTestServer> https_server_;
   base::test::ScopedFeatureList feature_list_;
   AllowlistedOriginContentBrowserClient content_browser_client_;
-  raw_ptr<ContentBrowserClient> old_content_browser_client_;
+  raw_ptr<ContentBrowserClient, DanglingUntriaged> old_content_browser_client_;
   std::unique_ptr<InterestGroupTestObserver> observer_;
-  raw_ptr<InterestGroupManagerImpl> manager_;
+  raw_ptr<InterestGroupManagerImpl, DanglingUntriaged> manager_;
   base::Lock requests_lock_;
   std::set<GURL> received_https_test_server_requests_
       GUARDED_BY(requests_lock_);

content/browser/isolated_origin_browsertest.cc

@@ -373,7 +373,7 @@ class OriginIsolationPrerenderOptInHeaderTest
   test::PrerenderTestHelper prerender_helper_;
 
  private:
-  raw_ptr<WebContents> prerender_web_contents_;
+  raw_ptr<WebContents, DanglingUntriaged> prerender_web_contents_;
 };  // class OriginIsolationPrerenderOptInHeaderTest
 
 // As in OriginIsolationOptInHeaderTest, but with same-process origin
@@ -2529,7 +2529,7 @@ class InjectIsolationRequestingNavigation
   }
 
   raw_ptr<OriginIsolationOptInHeaderTest> test_framework_;
-  raw_ptr<Shell> tab2_;
+  raw_ptr<Shell, DanglingUntriaged> tab2_;
   const GURL& url_;
   bool was_called_ = false;
 };

content/browser/loader/navigation_url_loader_impl.h

@@ -217,10 +217,11 @@ class CONTENT_EXPORT NavigationURLLoaderImpl
   // Records UKM for the navigation load.
   void RecordReceivedResponseUkmForOutermostMainFrame();
 
-  raw_ptr<NavigationURLLoaderDelegate> delegate_;
+  raw_ptr<NavigationURLLoaderDelegate, DanglingUntriaged> delegate_;
   raw_ptr<BrowserContext> browser_context_;
   raw_ptr<StoragePartitionImpl> storage_partition_;
-  raw_ptr<ServiceWorkerMainResourceHandle> service_worker_handle_;
+  raw_ptr<ServiceWorkerMainResourceHandle, DanglingUntriaged>
+      service_worker_handle_;
 
   std::unique_ptr<network::ResourceRequest> resource_request_;
   std::unique_ptr<NavigationRequestInfo> request_info_;

content/browser/manifest/manifest_browsertest.cc

@@ -71,7 +71,7 @@ class MockWebContentsDelegate : public WebContentsDelegate {
   }
 
  private:
-  raw_ptr<WebContents> web_contents_;
+  raw_ptr<WebContents, DanglingUntriaged> web_contents_;
   raw_ptr<ManifestBrowserTest> test_;
 };
 

content/browser/media/capture/web_contents_frame_tracker.cc

@@ -98,7 +98,7 @@ class WebContentsContext : public WebContentsFrameTracker::Context {
   base::ScopedClosureRunner capture_handle_;
 
   // The backing WebContents.
-  raw_ptr<WebContents> contents_;
+  raw_ptr<WebContents, DanglingUntriaged> contents_;
 };
 
 }  // namespace

content/browser/media/capture/web_contents_frame_tracker.h

@@ -154,7 +154,8 @@ class CONTENT_EXPORT WebContentsFrameTracker final
   // will be posted to the UI thread before the MouseCursorOverlayController
   // deleter task.
 #if !BUILDFLAG(IS_ANDROID)
-  raw_ptr<MouseCursorOverlayController> cursor_controller_ = nullptr;
+  raw_ptr<MouseCursorOverlayController, DanglingUntriaged> cursor_controller_ =
+      nullptr;
 #endif
 
   // We may not have a frame sink ID target at all times.

content/browser/media/media_keys_listener_manager_impl_browsertest.cc

@@ -154,8 +154,9 @@ class MediaKeysListenerManagerImplTest : public ContentBrowserTest {
 
  private:
   base::test::ScopedFeatureList scoped_feature_list_;
-  raw_ptr<MediaKeysListenerManagerImpl> media_keys_listener_manager_;
-  raw_ptr<MockMediaKeysListener> media_keys_listener_;
+  raw_ptr<MediaKeysListenerManagerImpl, DanglingUntriaged>
+      media_keys_listener_manager_;
+  raw_ptr<MockMediaKeysListener, DanglingUntriaged> media_keys_listener_;
   std::unique_ptr<TestMediaController> media_controller_;
 };
 

content/browser/media/session/media_session_impl_browsertest.cc

@@ -308,8 +308,8 @@ class MediaSessionImplBrowserTest : public ContentBrowserTest {
     return std::make_unique<net::test_server::BasicHttpResponse>();
   }
 
-  raw_ptr<MediaSessionImpl> media_session_;
-  raw_ptr<MockAudioFocusDelegate> mock_audio_focus_delegate_;
+  raw_ptr<MediaSessionImpl, DanglingUntriaged> media_session_;
+  raw_ptr<MockAudioFocusDelegate, DanglingUntriaged> mock_audio_focus_delegate_;
   std::unique_ptr<MockMediaSessionServiceImpl> mock_media_session_service_;
   net::EmbeddedTestServer favicon_server_;
   base::AtomicSequenceNumber favicon_calls_;

content/browser/media/session/media_session_impl_service_routing_unittest.cc

@@ -105,7 +105,7 @@ class MockMediaSessionPlayerObserver : public MediaSessionPlayerObserver {
   }
 
  private:
-  raw_ptr<RenderFrameHost> render_frame_host_;
+  raw_ptr<RenderFrameHost, DanglingUntriaged> render_frame_host_;
 
   const media_session::mojom::MediaAudioVideoState audio_video_state_;
 

content/browser/media/session/media_session_impl_uma_unittest.cc

@@ -82,7 +82,7 @@ class MockMediaSessionPlayerObserver : public MediaSessionPlayerObserver {
   }
 
  private:
-  raw_ptr<RenderFrameHost> render_frame_host_;
+  raw_ptr<RenderFrameHost, DanglingUntriaged> render_frame_host_;
   media::MediaContentType media_content_type_;
 };
 

content/browser/media/session/media_session_service_impl_browsertest.cc

@@ -91,7 +91,7 @@ class MockMediaSessionPlayerObserver : public MediaSessionPlayerObserver {
   }
 
  private:
-  raw_ptr<RenderFrameHost> render_frame_host_;
+  raw_ptr<RenderFrameHost, DanglingUntriaged> render_frame_host_;
 };
 
 void NavigateToURLAndWaitForFinish(Shell* window, const GURL& url) {

content/browser/media/session/mock_media_session_player_observer.h

@@ -100,7 +100,7 @@ class MockMediaSessionPlayerObserver : public MediaSessionPlayerObserver {
   // player_id. The value of the vector is the playing status and volume.
   std::vector<MockPlayer> players_;
 
-  raw_ptr<RenderFrameHost> render_frame_host_;
+  raw_ptr<RenderFrameHost, DanglingUntriaged> render_frame_host_;
 
   int received_resume_calls_ = 0;
   int received_suspend_calls_ = 0;

content/browser/picture_in_picture/video_picture_in_picture_content_browsertest.cc

@@ -140,7 +140,7 @@ class TestWebContentsDelegate : public WebContentsDelegate {
   bool is_in_picture_in_picture() const { return is_in_picture_in_picture_; }
 
  private:
-  const raw_ptr<Shell> shell_;
+  const raw_ptr<Shell, DanglingUntriaged> shell_;
   bool is_in_picture_in_picture_ = false;
 };
 

content/browser/quota/quota_change_browsertest.cc

@@ -99,7 +99,7 @@ class QuotaChangeBrowserTest : public ContentBrowserTest,
 
  private:
   bool is_incognito_;
-  raw_ptr<Shell> browser_ = nullptr;
+  raw_ptr<Shell, DanglingUntriaged> browser_ = nullptr;
   base::test::ScopedFeatureList feature_list_;
 };
 

content/browser/renderer_host/frame_tree.h

@@ -550,7 +550,7 @@ class CONTENT_EXPORT FrameTree {
   // the lifetime of the FrameTree. It is not a scoped_ptr because we need the
   // pointer to remain valid even while the FrameTreeNode is being destroyed,
   // since it's common for a node to test whether it's the root node.
-  raw_ptr<FrameTreeNode> root_;
+  raw_ptr<FrameTreeNode, DanglingUntriaged> root_;
 
   int focused_frame_tree_node_id_;
 

content/browser/renderer_host/input/fling_browsertest.cc

@@ -302,8 +302,8 @@ class BrowserSideFlingBrowserTest : public ContentBrowserTest {
   }
 
   std::unique_ptr<base::RunLoop> run_loop_;
-  raw_ptr<RenderWidgetHostViewBase> child_view_ = nullptr;
-  raw_ptr<RenderWidgetHostViewBase> root_view_ = nullptr;
+  raw_ptr<RenderWidgetHostViewBase, DanglingUntriaged> child_view_ = nullptr;
+  raw_ptr<RenderWidgetHostViewBase, DanglingUntriaged> root_view_ = nullptr;
 };
 
 // On Mac we don't have any touchscreen/touchpad fling events (GFS/GFC).

content/browser/renderer_host/input/fling_controller.h

@@ -162,9 +162,10 @@ class CONTENT_EXPORT FlingController {
     return !last_progress_time_.is_null();
   }
 
-  raw_ptr<FlingControllerEventSenderClient> event_sender_client_;
+  raw_ptr<FlingControllerEventSenderClient, DanglingUntriaged>
+      event_sender_client_;
 
-  raw_ptr<FlingControllerSchedulerClient> scheduler_client_;
+  raw_ptr<FlingControllerSchedulerClient, DanglingUntriaged> scheduler_client_;
 
   // An object tracking the state of touchpad on the delivery of mouse events to
   // the renderer to filter mouse immediately after a touchpad fling canceling

content/browser/renderer_host/input/touch_emulator.h

@@ -166,7 +166,8 @@ class CONTENT_EXPORT TouchEmulator : public ui::GestureProviderClient {
   blink::WebTouchEvent touch_event_;
   int emulated_stream_active_sequence_count_;
   int native_stream_active_sequence_count_;
-  raw_ptr<RenderWidgetHostViewBase> last_emulated_start_target_;
+  raw_ptr<RenderWidgetHostViewBase, DanglingUntriaged>
+      last_emulated_start_target_;
   // TODO(einbinder): this relies on synchronous tap gesture generation and does
   // not work for any other gestures. We should switch to callbacks which go
   // through touches and gestures once that's available.

content/browser/renderer_host/media/video_capture_browsertest.cc

@@ -239,8 +239,10 @@ class VideoCaptureBrowserTest : public ContentBrowserTest,
   base::test::ScopedFeatureList scoped_feature_list_;
 
   TestParams params_;
-  raw_ptr<MediaStreamManager> media_stream_manager_ = nullptr;
-  raw_ptr<VideoCaptureManager> video_capture_manager_ = nullptr;
+  raw_ptr<MediaStreamManager, DanglingUntriaged> media_stream_manager_ =
+      nullptr;
+  raw_ptr<VideoCaptureManager, DanglingUntriaged> video_capture_manager_ =
+      nullptr;
   base::UnguessableToken session_id_;
   const VideoCaptureControllerID stub_client_id_ =
       base::UnguessableToken::Create();

content/browser/renderer_host/navigation_controller_impl.h

@@ -801,7 +801,7 @@ class CONTENT_EXPORT NavigationControllerImpl : public NavigationController {
   // This may refer to an item in the entries_ list if the pending_entry_index_
   // != -1, or it may be its own entry that should be deleted. Be careful with
   // the memory management.
-  raw_ptr<NavigationEntryImpl> pending_entry_ = nullptr;
+  raw_ptr<NavigationEntryImpl, DanglingUntriaged> pending_entry_ = nullptr;
 
   // This keeps track of the NavigationRequests associated with the pending
   // NavigationEntry. When all of them have been deleted, or have stopped

content/browser/renderer_host/navigation_controller_impl_browsertest.cc

@@ -18783,7 +18783,7 @@ class SandboxedNavigationControllerPopupBrowserTest
   }
 
  protected:
-  raw_ptr<Shell> popup_shell_ = nullptr;
+  raw_ptr<Shell, DanglingUntriaged> popup_shell_ = nullptr;
 
  private:
   base::test::ScopedFeatureList feature_list_;

content/browser/renderer_host/render_frame_host_impl.h

@@ -4236,8 +4236,8 @@ class CONTENT_EXPORT RenderFrameHostImpl
   base::OnceClosure did_stop_loading_callback_;
 
   // Used when testing to retrieve that last created Web Bluetooth service.
-  raw_ptr<WebBluetoothServiceImpl> last_web_bluetooth_service_for_testing_ =
-      nullptr;
+  raw_ptr<WebBluetoothServiceImpl, DanglingUntriaged>
+      last_web_bluetooth_service_for_testing_ = nullptr;
 
   BackForwardCacheDisablingFeaturesCallback
       back_forward_cache_disabling_features_callback_for_testing_;

content/browser/renderer_host/render_frame_host_manager_browsertest.cc

@@ -194,7 +194,7 @@ class RenderFrameHostDestructionObserver : public WebContentsObserver {
  private:
   scoped_refptr<MessageLoopRunner> message_loop_runner_;
   bool deleted_;
-  raw_ptr<RenderFrameHost> render_frame_host_;
+  raw_ptr<RenderFrameHost, DanglingUntriaged> render_frame_host_;
 };
 
 // A NavigationThrottle implementation that blocks all outgoing navigation

content/browser/renderer_host/render_frame_host_manager_unittest.cc

@@ -740,7 +740,7 @@ class RenderViewHostDestroyer : public WebContentsObserver {
   }
 
  private:
-  raw_ptr<RenderViewHost> render_view_host_;
+  raw_ptr<RenderViewHost, DanglingUntriaged> render_view_host_;
   std::unique_ptr<WebContents> web_contents_;
 };
 

content/browser/renderer_host/render_process_host_browsertest.cc

@@ -668,7 +668,7 @@ class ShellCloser : public RenderProcessHostObserver {
     logging_string_->append("ShellCloser::RenderProcessHostDestroyed ");
   }
 
-  raw_ptr<Shell> shell_;
+  raw_ptr<Shell, DanglingUntriaged> shell_;
   raw_ptr<std::string> logging_string_;
 };
 

content/browser/renderer_host/render_widget_host_browsertest.cc

@@ -213,9 +213,9 @@ class RenderWidgetHostTouchEmulatorBrowserTest : public ContentBrowserTest {
   RenderWidgetHostViewBase* view() { return view_; }
 
  private:
-  raw_ptr<RenderWidgetHostViewBase> view_;
-  raw_ptr<RenderWidgetHostImpl> host_;
-  raw_ptr<RenderWidgetHostInputEventRouter> router_;
+  raw_ptr<RenderWidgetHostViewBase, DanglingUntriaged> view_;
+  raw_ptr<RenderWidgetHostImpl, DanglingUntriaged> host_;
+  raw_ptr<RenderWidgetHostInputEventRouter, DanglingUntriaged> router_;
 
   base::TimeTicks last_simulated_event_time_;
   const base::TimeDelta simulated_event_time_delta_;

content/browser/renderer_host/render_widget_host_impl.h

@@ -1132,7 +1132,7 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   // An expiry time for resetting the pending_user_activation_timer_.
   static const base::TimeDelta kActivationNotificationExpireTime;
 
-  raw_ptr<FrameTree> frame_tree_;
+  raw_ptr<FrameTree, DanglingUntriaged> frame_tree_;
 
   // RenderWidgetHost are either:
   // - Owned by RenderViewHostImpl.
@@ -1166,7 +1166,8 @@ class CONTENT_EXPORT RenderWidgetHostImpl
   // The delegate of the owner of this object.
   // This member is non-null if and only if this RenderWidgetHost is associated
   // with a main frame RenderWidget.
-  raw_ptr<RenderWidgetHostOwnerDelegate> owner_delegate_ = nullptr;
+  raw_ptr<RenderWidgetHostOwnerDelegate, DanglingUntriaged> owner_delegate_ =
+      nullptr;
 
   // AgentSchedulingGroupHost to be used for IPC with the corresponding
   // (renderer-side) AgentSchedulingGroup. Its channel may be nullptr if the

content/browser/renderer_host/render_widget_host_input_event_router.h

@@ -379,7 +379,8 @@ class CONTENT_EXPORT RenderWidgetHostInputEventRouter final
 
   // Tracked for the purpose of providing a root_view when dispatching emulated
   // touch/gesture events.
-  raw_ptr<RenderWidgetHostViewBase> last_emulated_event_root_view_;
+  raw_ptr<RenderWidgetHostViewBase, DanglingUntriaged>
+      last_emulated_event_root_view_;
 
   // Used to send a GSE with proper source device to terminate scroll bubbling
   // whenever needed.

content/browser/screen_enumeration/screen_enumeration_browsertest.cc

@@ -163,7 +163,7 @@ class FakeScreenEnumerationTest : public ScreenEnumerationTest {
 
  private:
   display::ScreenBase screen_;
-  raw_ptr<Shell> test_shell_ = nullptr;
+  raw_ptr<Shell, DanglingUntriaged> test_shell_ = nullptr;
 };
 
 // TODO(crbug.com/1042990): Windows crashes static casting to ScreenWin.

content/browser/service_worker/service_worker_cache_writer.cc

@@ -761,7 +761,7 @@ class ServiceWorkerCacheWriter::DataPipeReader
   }
 
   // Parameters set on Read().
-  raw_ptr<net::IOBuffer> buffer_ = nullptr;
+  raw_ptr<net::IOBuffer, DanglingUntriaged> buffer_ = nullptr;
   uint32_t num_bytes_to_read_ = 0;
   ReadCallback callback_;
 

content/browser/service_worker/service_worker_cache_writer.h

@@ -327,7 +327,7 @@ class CONTENT_EXPORT ServiceWorkerCacheWriter {
   // cache writer pauses immediately.
   const bool pause_when_not_identical_;
 
-  raw_ptr<WriteObserver> write_observer_ = nullptr;
+  raw_ptr<WriteObserver, DanglingUntriaged> write_observer_ = nullptr;
 
   mojo::Remote<storage::mojom::ServiceWorkerResourceReader> compare_reader_;
   std::unique_ptr<DataPipeReader> compare_data_pipe_reader_;

content/browser/service_worker/service_worker_internals_ui_browsertest.cc

@@ -520,7 +520,7 @@ class ServiceWorkerInternalsUIBrowserTest : public ContentBrowserTest {
  private:
   base::test::ScopedFeatureList feature_list_;
   scoped_refptr<ServiceWorkerContextWrapper> wrapper_;
-  raw_ptr<Shell> active_shell_ = shell();
+  raw_ptr<Shell, DanglingUntriaged> active_shell_ = shell();
 };
 
 // Tests

content/browser/service_worker/service_worker_object_host.h

@@ -104,7 +104,7 @@ class CONTENT_EXPORT ServiceWorkerObjectHost
   base::WeakPtr<ServiceWorkerContextCore> context_;
   // |container_host_| is valid throughout lifetime of |this| because it owns
   // |this|.
-  const raw_ptr<ServiceWorkerContainerHost> container_host_;
+  const raw_ptr<ServiceWorkerContainerHost, DanglingUntriaged> container_host_;
   // The origin of the |container_host_|. Note that this is const because once a
   // JavaScript ServiceWorker object is created for an execution context, we
   // don't expect that context to change origins and still hold on to the

content/browser/service_worker/service_worker_process_manager.h

@@ -132,7 +132,7 @@ class CONTENT_EXPORT ServiceWorkerProcessManager {
   // All fields below are only accessed on the UI thread.
 
   // May be null during initialization and in unit tests.
-  raw_ptr<StoragePartitionImpl> storage_partition_;
+  raw_ptr<StoragePartitionImpl, DanglingUntriaged> storage_partition_;
 
   // Maps the ID of a running EmbeddedWorkerInstance to the SiteInstance whose
   // renderer process it's running inside. Since the embedded workers themselves

content/browser/shared_storage/shared_storage_browsertest.cc

@@ -402,8 +402,8 @@ class SharedStorageBrowserTest : public ContentBrowserTest {
   base::test::ScopedFeatureList scoped_feature_list_;
   net::EmbeddedTestServer https_server_{net::EmbeddedTestServer::TYPE_HTTPS};
 
-  raw_ptr<TestSharedStorageWorkletHostManager> test_worklet_host_manager_ =
-      nullptr;
+  raw_ptr<TestSharedStorageWorkletHostManager, DanglingUntriaged>
+      test_worklet_host_manager_ = nullptr;
 };
 
 IN_PROC_BROWSER_TEST_F(SharedStorageBrowserTest, AddModule_Success) {

content/browser/shared_storage/shared_storage_worklet_host.h

@@ -183,7 +183,8 @@ class CONTENT_EXPORT SharedStorageWorkletHost
   // Both `this` and `shared_storage_manager_` live in the `StoragePartition`.
   // `shared_storage_manager_` almost always outlives `this` (thus is valid)
   // except for inside `~SharedStorageWorkletHost()`.
-  raw_ptr<storage::SharedStorageManager> shared_storage_manager_;
+  raw_ptr<storage::SharedStorageManager, DanglingUntriaged>
+      shared_storage_manager_;
 
   // Pointer to the `BrowserContext`, saved to be able to call
   // `IsSharedStorageAllowed()`.

content/browser/site_per_process_hit_test_browsertest.cc

@@ -4590,7 +4590,7 @@ class SitePerProcessMouseWheelHitTestBrowserTest
   }
 
  private:
-  raw_ptr<RenderWidgetHostViewAura> rwhv_root_;
+  raw_ptr<RenderWidgetHostViewAura, DanglingUntriaged> rwhv_root_;
 };
 
 // Fails on Windows official build, see // https://crbug.com/800822
@@ -6409,10 +6409,10 @@ class SitePerProcessGestureHitTestBrowserTest
   }
 
  protected:
-  raw_ptr<RenderWidgetHostViewBase> rwhv_child_;
-  raw_ptr<RenderWidgetHostViewAura> rwhva_root_;
-  raw_ptr<RenderWidgetHostImpl> rwhi_child_;
-  raw_ptr<RenderWidgetHostImpl> rwhi_root_;
+  raw_ptr<RenderWidgetHostViewBase, DanglingUntriaged> rwhv_child_;
+  raw_ptr<RenderWidgetHostViewAura, DanglingUntriaged> rwhva_root_;
+  raw_ptr<RenderWidgetHostImpl, DanglingUntriaged> rwhi_child_;
+  raw_ptr<RenderWidgetHostImpl, DanglingUntriaged> rwhi_root_;
 };
 
 IN_PROC_BROWSER_TEST_F(SitePerProcessGestureHitTestBrowserTest,

content/browser/speech/audio_encoder.h

@@ -42,7 +42,7 @@ class AudioEncoder {
  private:
   AudioBuffer encoded_audio_buffer_;
 
-  raw_ptr<FLAC__StreamEncoder> encoder_;
+  raw_ptr<FLAC__StreamEncoder, DanglingUntriaged> encoder_;
   bool is_encoder_initialized_;
 };
 

content/browser/speech/speech_recognition_browsertest.cc

@@ -124,7 +124,7 @@ class MockCapturerSource : public media::AudioCapturerSource {
  private:
   StartCallback start_callback_;
   StopCallback stop_callback_;
-  raw_ptr<CaptureCallback> capture_callback_;
+  raw_ptr<CaptureCallback, DanglingUntriaged> capture_callback_;
   media::AudioParameters audio_parameters_;
 };
 

content/browser/speech/tts_utterance_impl.h

@@ -123,7 +123,7 @@ class CONTENT_EXPORT TtsUtteranceImpl : public TtsUtterance {
   GURL src_url_;
 
   // The delegate to be called when an utterance event is fired.
-  raw_ptr<UtteranceEventDelegate> event_delegate_ = nullptr;
+  raw_ptr<UtteranceEventDelegate, DanglingUntriaged> event_delegate_ = nullptr;
 
   // The parsed options.
   std::string voice_name_;

content/browser/tracing/tracing_controller_impl_data_endpoint.cc

@@ -144,7 +144,7 @@ class FileTraceDataEndpoint : public TracingController::TraceDataEndpoint {
   base::FilePath file_path_;
   base::FilePath pending_file_path_;
   base::OnceClosure completion_callback_;
-  raw_ptr<FILE> file_ = nullptr;
+  raw_ptr<FILE, DanglingUntriaged> file_ = nullptr;
   const scoped_refptr<base::SequencedTaskRunner> may_block_task_runner_;
 };
 

content/browser/web_contents/web_contents_impl_browsertest.cc

@@ -3681,7 +3681,7 @@ class FullscreenWebContentsObserver : public WebContentsObserver {
  private:
   base::RunLoop run_loop_;
   bool found_value_ = false;
-  raw_ptr<RenderFrameHost> wanted_rfh_;
+  raw_ptr<RenderFrameHost, DanglingUntriaged> wanted_rfh_;
 };
 
 }  // namespace

content/browser/web_contents/web_contents_view_aura_browsertest.cc

@@ -292,7 +292,7 @@ class WebContentsViewAuraTest : public ContentBrowserTest {
     ContentBrowserTest::PostRunTestOnMainThread();
   }
 
-  raw_ptr<RenderWidgetHostImpl> drop_target_widget_;
+  raw_ptr<RenderWidgetHostImpl, DanglingUntriaged> drop_target_widget_;
 
   // A closure indicating that async drop operation has completed.
   base::OnceClosure async_drop_closure_;