Extend MiraclePtr coverage to more containers

This rewrites the following containers:
std::list, std::unordered_set, base::flat_set, std::stack, std::queue.

This patch was generated by running
./tools/clang/rewrite_templated_container_fields/rewrite-multiple-platforms.sh

Binary size increase:
The increase is only (~9.5kB) above the per-patch limit (+16kB). This
is not a lot given the size of the rewrite. Increase of around 500kb was
approved for MiraclePtr.

AX-Relnotes: n/a.
Binary-Size: See commit description.
Bug: 325302189
Change-Id: I969ae345ef6d6117d5c1773773be913197ca2e73
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5306923
Reviewed-by: Kentaro Hara <haraken@chromium.org>
Commit-Queue: Ali Hijazi <ahijazi@chromium.org>
Owners-Override: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1265100}

android_webview/browser/aw_contents_io_thread_client.cc

@@ -22,6 +22,7 @@
 #include "base/functional/bind.h"
 #include "base/lazy_instance.h"
 #include "base/logging.h"
+#include "base/memory/raw_ptr.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/synchronization/lock.h"
 #include "base/threading/scoped_blocking_call.h"
@@ -57,7 +58,8 @@ namespace {
 typedef map<content::GlobalRenderFrameHostToken, JavaObjectWeakGlobalRef>
     RenderFrameHostToWeakGlobalRefType;
 
-typedef pair<base::flat_set<RenderFrameHost*>, JavaObjectWeakGlobalRef>
+typedef pair<base::flat_set<raw_ptr<RenderFrameHost, CtnExperimental>>,
+             JavaObjectWeakGlobalRef>
     HostsAndWeakGlobalRefPair;
 
 // When browser side navigation is enabled, RenderFrameIDs do not have

ash/ambient/metrics/ambient_animation_metrics_recorder.h

@@ -57,7 +57,8 @@ class ASH_EXPORT AmbientAnimationMetricsRecorder
       const lottie::Animation& animation_r) const;
 
   const AmbientUiSettings ui_settings_;
-  base::flat_set<const lottie::Animation*> registered_animations_;
+  base::flat_set<raw_ptr<const lottie::Animation, CtnExperimental>>
+      registered_animations_;
   base::ScopedMultiSourceObservation<lottie::Animation,
                                      lottie::AnimationObserver>
       animation_observations_{this};

ash/ambient/ui/ambient_animation_progress_tracker.cc

@@ -9,15 +9,17 @@
 
 #include "base/check.h"
 #include "base/logging.h"
+#include "base/memory/raw_ptr.h"
 #include "base/notreached.h"
 
 namespace ash {
 
 namespace {
 
-void MoveAnimation(base::flat_set<const lottie::Animation*>& from,
-                   base::flat_set<const lottie::Animation*>& to,
-                   const lottie::Animation* animation) {
+void MoveAnimation(
+    base::flat_set<raw_ptr<const lottie::Animation, CtnExperimental>>& from,
+    base::flat_set<raw_ptr<const lottie::Animation, CtnExperimental>>& to,
+    const lottie::Animation* animation) {
   if (to.contains(animation)) {
     CHECK(!from.contains(animation));
     return;

ash/ambient/ui/ambient_animation_progress_tracker.h

@@ -9,6 +9,7 @@
 
 #include "ash/ash_export.h"
 #include "base/containers/flat_set.h"
+#include "base/memory/raw_ptr.h"
 #include "base/scoped_multi_source_observation.h"
 #include "ui/lottie/animation.h"
 #include "ui/lottie/animation_observer.h"
@@ -87,9 +88,11 @@ class ASH_EXPORT AmbientAnimationProgressTracker
                                      lottie::AnimationObserver>
       animation_observations_{this};
   // Registered animations that have been Start()ed.
-  base::flat_set<const lottie::Animation*> started_animations_;
+  base::flat_set<raw_ptr<const lottie::Animation, CtnExperimental>>
+      started_animations_;
   // Registered animations that have not been Start()ed yet.
-  base::flat_set<const lottie::Animation*> inactive_animations_;
+  base::flat_set<raw_ptr<const lottie::Animation, CtnExperimental>>
+      inactive_animations_;
 };
 
 }  // namespace ash

ash/components/arc/compat_mode/arc_resize_lock_manager.h

@@ -87,7 +87,8 @@ class ArcResizeLockManager : public KeyedService,
 
   std::unique_ptr<TouchModeMouseRewriter> touch_mode_mouse_rewriter_;
 
-  base::flat_set<aura::Window*> resize_lock_enabled_windows_;
+  base::flat_set<raw_ptr<aura::Window, CtnExperimental>>
+      resize_lock_enabled_windows_;
 
   base::ScopedObservation<aura::Env, aura::EnvObserver> env_observation{this};
 

ash/components/arc/compat_mode/arc_resize_lock_manager_unittest.cc

@@ -71,7 +71,8 @@ class TestCompatModeButtonController : public CompatModeButtonController {
   }
 
  private:
-  base::flat_set<const aura::Window*> update_compat_mode_button_called;
+  base::flat_set<raw_ptr<const aura::Window, CtnExperimental>>
+      update_compat_mode_button_called;
 };
 
 class TestArcResizeLockManager : public ArcResizeLockManager {

ash/system/unified/unified_system_tray.cc

@@ -550,7 +550,7 @@ void UnifiedSystemTray::DestroyBubble() {
 }
 
 void UnifiedSystemTray::UpdateTrayItemColor(bool is_active) {
-  for (auto* tray_item : tray_items_) {
+  for (TrayItemView* tray_item : tray_items_) {
     tray_item->UpdateLabelOrImageViewColor(is_active);
   }
 }

ash/system/unified/unified_system_tray.h

@@ -256,7 +256,7 @@ class ASH_EXPORT UnifiedSystemTray
   raw_ptr<ChannelIndicatorView> channel_indicator_view_ = nullptr;
 
   // Contains all tray items views added to tray_container().
-  std::list<TrayItemView*> tray_items_;
+  std::list<raw_ptr<TrayItemView, CtnExperimental>> tray_items_;
 
   bool first_interaction_recorded_ = false;
 

ash/utility/occlusion_tracker_pauser.h

@@ -8,6 +8,7 @@
 #include <memory>
 
 #include "ash/ash_export.h"
+#include "base/memory/raw_ptr.h"
 #include "base/scoped_multi_source_observation.h"
 #include "base/time/time.h"
 #include "base/timer/timer.h"
@@ -49,7 +50,8 @@ class ASH_EXPORT OcclusionTrackerPauser : public ui::CompositorObserver {
 
   // Keeps track of compositors that are animating. We can unpause when this is
   // empty.
-  base::flat_set<ui::Compositor*> animating_compositors_;
+  base::flat_set<raw_ptr<ui::Compositor, CtnExperimental>>
+      animating_compositors_;
 
   std::unique_ptr<aura::WindowOcclusionTracker::ScopedPause> scoped_pause_;
 };

ash/wm/desks/desks_controller.cc

@@ -499,7 +499,8 @@ DesksController::GetVisibleOnAllDesksWindowsOnRoot(
     aura::Window* root_window) const {
   DCHECK(root_window->IsRootWindow());
   base::flat_set<aura::Window*> filtered_visible_on_all_desks_windows;
-  for (auto* visible_on_all_desks_window : visible_on_all_desks_windows_) {
+  for (aura::Window* visible_on_all_desks_window :
+       visible_on_all_desks_windows_) {
     if (visible_on_all_desks_window->GetRootWindow() == root_window)
       filtered_visible_on_all_desks_windows.insert(visible_on_all_desks_window);
   }
@@ -2285,7 +2286,8 @@ void DesksController::MoveVisibleOnAllDesksWindowsFromActiveDeskTo(
   auto* mru_tracker = Shell::Get()->mru_window_tracker();
   mru_tracker->SetIgnoreActivations(true);
 
-  for (auto* visible_on_all_desks_window : visible_on_all_desks_windows_) {
+  for (aura::Window* visible_on_all_desks_window :
+       visible_on_all_desks_windows_) {
     MoveWindowFromActiveDeskTo(
         visible_on_all_desks_window, new_desk,
         visible_on_all_desks_window->GetRootWindow(),
@@ -2323,7 +2325,8 @@ void DesksController::RestackVisibleOnAllDesksWindowsOnActiveDesk() {
 
   auto mru_windows =
       Shell::Get()->mru_window_tracker()->BuildMruWindowList(kActiveDesk);
-  for (auto* visible_on_all_desks_window : visible_on_all_desks_windows_) {
+  for (aura::Window* visible_on_all_desks_window :
+       visible_on_all_desks_windows_) {
     // If the window is floated, it will always be on top, so there is no need
     // to restack it.
     if (WindowState::Get(visible_on_all_desks_window)->IsFloated()) {

ash/wm/desks/desks_controller.h

@@ -136,7 +136,8 @@ class ASH_EXPORT DesksController : public chromeos::DesksHelper,
 
   const Desk* active_desk() const { return active_desk_; }
 
-  const base::flat_set<aura::Window*>& visible_on_all_desks_windows() const {
+  const base::flat_set<raw_ptr<aura::Window, CtnExperimental>>&
+  visible_on_all_desks_windows() const {
     return visible_on_all_desks_windows_;
   }
 
@@ -534,7 +535,8 @@ class ASH_EXPORT DesksController : public chromeos::DesksHelper,
   // Stores visible on all desks windows, that is normal type windows with
   // normal z-ordering and are visible on all workspaces. Store here to prevent
   // repeatedly retrieving these windows on desk switches.
-  base::flat_set<aura::Window*> visible_on_all_desks_windows_;
+  base::flat_set<raw_ptr<aura::Window, CtnExperimental>>
+      visible_on_all_desks_windows_;
 
   // True when desks addition, removal, or activation change are in progress.
   // This can be checked when overview mode is active to avoid exiting overview

ash/wm/raster_scale/raster_scale_controller.cc

@@ -176,7 +176,7 @@ void RasterScaleController::Unpause() {
   pause_count_--;
   DCHECK_GE(pause_count_, 0);
   if (pause_count_ == 0) {
-    for (auto* window : pending_windows_) {
+    for (aura::Window* window : pending_windows_) {
       MaybeSetRasterScale(window);
 
       // If we kept observing a window since it had a pending change, we can

ash/wm/raster_scale/raster_scale_controller.h

@@ -11,6 +11,7 @@
 #include "ash/ash_export.h"
 #include "base/containers/flat_map.h"
 #include "base/containers/flat_set.h"
+#include "base/memory/raw_ptr.h"
 #include "base/scoped_multi_source_observation.h"
 #include "ui/aura/window.h"
 #include "ui/aura/window_observer.h"
@@ -132,7 +133,7 @@ class ASH_EXPORT RasterScaleController : public aura::WindowObserver {
 
   // Holds a set of windows that have had their raster scales change while
   // RasterScaleController is paused.
-  base::flat_set<aura::Window*> pending_windows_;
+  base::flat_set<raw_ptr<aura::Window, CtnExperimental>> pending_windows_;
 
   // Raster scale won't be updated for a window unless the currently requested
   // raster scale is more than `raster_scale_slop_proportion_` different by

ash/wm/raster_scale/raster_scale_layer_observer.cc

@@ -306,7 +306,7 @@ void RasterScaleLayerObserver::SetRasterScales(float raster_scale) {
 
   ScopedSetRasterScale::SetOrUpdateRasterScale(apply_window_, raster_scale,
                                                &raster_scales_[apply_window_]);
-  for (auto* window : transient_windows_) {
+  for (aura::Window* window : transient_windows_) {
     ScopedSetRasterScale::SetOrUpdateRasterScale(window, raster_scale,
                                                  &raster_scales_[window]);
   }

ash/wm/raster_scale/raster_scale_layer_observer.h

@@ -9,6 +9,7 @@
 #include "ash/wm/raster_scale/raster_scale_controller.h"
 #include "base/containers/flat_map.h"
 #include "base/containers/flat_set.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/ref_counted.h"
 #include "ui/aura/client/transient_window_client_observer.h"
 #include "ui/aura/window_observer.h"
@@ -136,7 +137,7 @@ class RasterScaleLayerObserver
   // We need to hold onto transient windows to apply the same raster scale to
   // them as the main `apply_window_`, and to unapply them when they are done.
   // The raster scale locks for transient windows are held in `raster_scales_`.
-  base::flat_set<aura::Window*> transient_windows_;
+  base::flat_set<raw_ptr<aura::Window, CtnExperimental>> transient_windows_;
 
   // Holds raster scale locks for windows. This will be `apply_window_` plus any
   // transient children windows.

ash/wm/tablet_mode/tablet_mode_window_manager.h

@@ -18,6 +18,7 @@
 #include "ash/wm/overview/overview_observer.h"
 #include "ash/wm/splitview/split_view_controller.h"
 #include "ash/wm/splitview/split_view_observer.h"
+#include "base/memory/raw_ptr.h"
 #include "ui/aura/window_observer.h"
 #include "ui/compositor/layer_animation_observer.h"
 #include "ui/display/display_observer.h"
@@ -191,11 +192,12 @@ class ASH_EXPORT TabletModeWindowManager : public aura::WindowObserver,
   WindowToState window_state_map_;
 
   // All container windows which have to be tracked.
-  std::unordered_set<aura::Window*> observed_container_windows_;
+  std::unordered_set<raw_ptr<aura::Window, CtnExperimental>>
+      observed_container_windows_;
 
   // Windows added to the container, but not yet shown or tracked. They will be
   // attempted to be tracked when the window is shown.
-  std::unordered_set<aura::Window*> windows_to_track_;
+  std::unordered_set<raw_ptr<aura::Window, CtnExperimental>> windows_to_track_;
 
   // All accounts that have been active at least once since tablet mode started.
   base::flat_set<AccountId> accounts_since_entering_tablet_;

ash/wm/window_preview_view.cc

@@ -51,8 +51,9 @@ WindowPreviewView::WindowPreviewView(aura::Window* window) : window_(window) {
 }
 
 WindowPreviewView::~WindowPreviewView() {
-  for (auto* window : unparented_transient_children_)
+  for (aura::Window* window : unparented_transient_children_) {
     window->RemoveObserver(this);
+  }
   for (auto entry : mirror_views_)
     entry.first->RemoveObserver(this);
   aura::client::GetTransientWindowClient()->RemoveObserver(this);

ash/wm/window_preview_view.h

@@ -73,7 +73,8 @@ class ASH_EXPORT WindowPreviewView
   // actually parented; i.e. `OnTransientChildWindowAdded()` is called before
   // `transient_child->parent()` is set. We track those here so that we can add
   // them to the view once they're parented.
-  base::flat_set<aura::Window*> unparented_transient_children_;
+  base::flat_set<raw_ptr<aura::Window, CtnExperimental>>
+      unparented_transient_children_;
 };
 
 }  // namespace ash

ash/wm/window_restore/window_restore_controller.h

@@ -161,7 +161,7 @@ class ASH_EXPORT WindowRestoreController
 
   // The set of windows that have had their widgets initialized and will be
   // shown later.
-  base::flat_set<aura::Window*> to_be_shown_windows_;
+  base::flat_set<raw_ptr<aura::Window, CtnExperimental>> to_be_shown_windows_;
 
   // When a window is restored, we post a task to clear its
   // `app_restore::kLaunchedFromAppRestoreKey` property. However, a window can

ash/wm_mode/pie_menu_view.cc

@@ -462,7 +462,7 @@ void PieMenuView::OpenSubMenu(PieSubMenuContainerView* sub_menu) {
   DCHECK(sub_menu);
   main_menu_container_->SetVisible(false);
   if (!active_sub_menus_stack_.empty()) {
-    auto* top_sub_menu = active_sub_menus_stack_.top();
+    auto* top_sub_menu = active_sub_menus_stack_.top().get();
     top_sub_menu->SetVisible(false);
   }
   active_sub_menus_stack_.push(sub_menu);
@@ -472,7 +472,7 @@ void PieMenuView::OpenSubMenu(PieSubMenuContainerView* sub_menu) {
 
 void PieMenuView::MaybePopSubMenu() {
   if (!active_sub_menus_stack_.empty()) {
-    auto* top_sub_menu = active_sub_menus_stack_.top();
+    auto* top_sub_menu = active_sub_menus_stack_.top().get();
     top_sub_menu->SetVisible(false);
     active_sub_menus_stack_.pop();
   }

ash/wm_mode/pie_menu_view.h

@@ -172,7 +172,8 @@ class ASH_EXPORT PieMenuView : public views::View {
   // pressing on `back_button_` pops the top-most sub menu to show the previous
   // one, until there are no more active sub menus, at which point
   // `main_menu_container_` shows up and `back_button_` hides.
-  std::stack<PieSubMenuContainerView*> active_sub_menus_stack_;
+  std::stack<raw_ptr<PieSubMenuContainerView, CtnExperimental>>
+      active_sub_menus_stack_;
 
   const raw_ptr<views::ImageButton> back_button_;
 

base/metrics/ranges_manager.cc

@@ -45,7 +45,7 @@ std::vector<const BucketRanges*> RangesManager::GetBucketRanges() const {
 }
 
 void RangesManager::ReleaseBucketRanges() {
-  for (auto* range : GetRanges()) {
+  for (const BucketRanges* range : GetRanges()) {
     delete range;
   }
   GetRanges().clear();

base/metrics/ranges_manager.h

@@ -9,6 +9,7 @@
 #include <vector>
 
 #include "base/base_export.h"
+#include "base/memory/raw_ptr.h"
 #include "base/metrics/bucket_ranges.h"
 #include "base/synchronization/lock.h"
 
@@ -61,9 +62,10 @@ class BASE_EXPORT RangesManager {
 
   // Type for a set of unique RangesBucket, with their hash and equivalence
   // defined by `BucketRangesHash` and `BucketRangesEqual`.
-  typedef std::
-      unordered_set<const BucketRanges*, BucketRangesHash, BucketRangesEqual>
-          RangesMap;
+  typedef std::unordered_set<raw_ptr<const BucketRanges, CtnExperimental>,
+                             BucketRangesHash,
+                             BucketRangesEqual>
+      RangesMap;
 
   // Removes all registered BucketRanges and destroys them. This is called in
   // the destructor.

base/synchronization/waitable_event.h

@@ -9,6 +9,7 @@
 
 #include "base/base_export.h"
 #include "base/compiler_specific.h"
+#include "base/memory/raw_ptr.h"
 #include "build/build_config.h"
 
 #if BUILDFLAG(IS_WIN)
@@ -237,7 +238,7 @@ class BASE_EXPORT WaitableEvent {
     base::Lock lock_;
     const bool manual_reset_;
     bool signaled_;
-    std::list<Waiter*> waiters_;
+    std::list<raw_ptr<Waiter, CtnExperimental>> waiters_;
 
    private:
     friend class RefCountedThreadSafe<WaitableEventKernel>;

base/synchronization/waitable_event_posix.cc

@@ -375,7 +375,7 @@ WaitableEvent::WaitableEventKernel::~WaitableEventKernel() = default;
 bool WaitableEvent::SignalAll() {
   bool signaled_at_least_one = false;
 
-  for (auto* i : kernel_->waiters_) {
+  for (Waiter* i : kernel_->waiters_) {
     if (i->Fire(this))
       signaled_at_least_one = true;
   }

base/threading/simple_thread.h

@@ -225,7 +225,7 @@ class BASE_EXPORT DelegateSimpleThreadPool
   const std::string name_prefix_;
   size_t num_threads_;
   std::vector<std::unique_ptr<DelegateSimpleThread>> threads_;
-  base::queue<Delegate*> delegates_;
+  base::queue<raw_ptr<Delegate, CtnExperimental>> delegates_;
   base::Lock lock_;            // Locks delegates_
   WaitableEvent dry_;    // Not signaled when there is no work to do.
 };

cc/tiles/tile_manager.h

@@ -509,7 +509,7 @@ class CC_EXPORT TileManager : CheckerImageTrackerClient,
   uint64_t prepare_tiles_count_;
   uint64_t next_tile_id_;
 
-  std::unordered_set<Tile*> pending_gpu_work_tiles_;
+  std::unordered_set<raw_ptr<Tile, CtnExperimental>> pending_gpu_work_tiles_;
   uint64_t pending_required_for_activation_callback_id_ = 0;
   uint64_t pending_required_for_draw_callback_id_ = 0;
   // If true, we should re-compute tile requirements in

cc/trees/animated_paint_worklet_tracker.cc

@@ -9,6 +9,7 @@
 #include <vector>
 
 #include "base/containers/cxx20_erase.h"
+#include "base/memory/raw_ptr.h"
 #include "cc/layers/picture_layer_impl.h"
 
 namespace cc {
@@ -19,7 +20,7 @@ AnimatedPaintWorkletTracker::~AnimatedPaintWorkletTracker() = default;
 
 AnimatedPaintWorkletTracker::PropertyState::PropertyState(
     PaintWorkletInput::PropertyValue value,
-    base::flat_set<PictureLayerImpl*> layers)
+    base::flat_set<raw_ptr<PictureLayerImpl, CtnExperimental>> layers)
     : animation_value(value), associated_layers(std::move(layers)) {}
 
 AnimatedPaintWorkletTracker::PropertyState::PropertyState() = default;
@@ -57,7 +58,7 @@ bool AnimatedPaintWorkletTracker::InvalidatePaintWorkletsOnPendingTree() {
     if (it == input_properties_.end()) {
       continue;
     }
-    for (auto* layer : it->second.associated_layers) {
+    for (PictureLayerImpl* layer : it->second.associated_layers) {
       layer->InvalidatePaintWorklets(
           prop_key, input_properties_.find(prop_key)->second.animation_value,
           input_properties_.find(prop_key)->second.last_animation_value);

cc/trees/animated_paint_worklet_tracker.h

@@ -10,6 +10,7 @@
 
 #include "base/containers/flat_map.h"
 #include "base/containers/flat_set.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "cc/cc_export.h"
 #include "cc/paint/discardable_image_map.h"
@@ -76,8 +77,9 @@ class CC_EXPORT AnimatedPaintWorkletTracker {
   //      invalidate them when the property's value is changed by an animation.
   struct PropertyState {
     PropertyState();
-    explicit PropertyState(PaintWorkletInput::PropertyValue value,
-                           base::flat_set<PictureLayerImpl*> layers);
+    explicit PropertyState(
+        PaintWorkletInput::PropertyValue value,
+        base::flat_set<raw_ptr<PictureLayerImpl, CtnExperimental>> layers);
     PropertyState(const PropertyState&);
     ~PropertyState();
 
@@ -88,7 +90,8 @@ class CC_EXPORT AnimatedPaintWorkletTracker {
     // next commit.
     PaintWorkletInput::PropertyValue animation_value;
     PaintWorkletInput::PropertyValue last_animation_value;
-    base::flat_set<PictureLayerImpl*> associated_layers;
+    base::flat_set<raw_ptr<PictureLayerImpl, CtnExperimental>>
+        associated_layers;
   };
 
   // The set of input properties managed by AnimatedPaintWorkletTracker.

cc/trees/commit_state.h

@@ -157,7 +157,8 @@ struct CC_EXPORT CommitState {
   std::vector<UIResourceRequest> ui_resource_request_queue;
   base::flat_map<UIResourceId, gfx::Size> ui_resource_sizes;
   PropertyTreesChangeState property_trees_change_state;
-  base::flat_set<Layer*> layers_that_should_push_properties;
+  base::flat_set<raw_ptr<Layer, CtnExperimental>>
+      layers_that_should_push_properties;
 };
 
 struct CC_EXPORT ThreadUnsafeCommitState {

cc/trees/image_animation_controller.cc

@@ -8,6 +8,7 @@
 #include <sstream>
 
 #include "base/functional/bind.h"
+#include "base/memory/raw_ptr.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/notreached.h"
 #include "base/task/single_thread_task_runner.h"
@@ -202,7 +203,8 @@ void ImageAnimationController::WillBeginImplFrame(
   scheduler_.WillBeginImplFrame(args);
 }
 
-const base::flat_set<ImageAnimationController::AnimationDriver*>&
+const base::flat_set<
+    raw_ptr<ImageAnimationController::AnimationDriver, CtnExperimental>>&
 ImageAnimationController::GetDriversForTesting(
     PaintImage::Id paint_image_id) const {
   const auto& it = animation_state_map_.find(paint_image_id);
@@ -494,7 +496,7 @@ void ImageAnimationController::AnimationState::RemoveDriver(
 
 void ImageAnimationController::AnimationState::UpdateStateFromDrivers() {
   should_animate_from_drivers_ = false;
-  for (auto* driver : drivers_) {
+  for (AnimationDriver* driver : drivers_) {
     if (driver->ShouldAnimate(paint_image_id_)) {
       should_animate_from_drivers_ = true;
       break;

cc/trees/image_animation_controller.h

@@ -123,8 +123,8 @@ class CC_EXPORT ImageAnimationController {
   bool did_navigate() const { return did_navigate_; }
   void set_did_navigate() { did_navigate_ = true; }
 
-  const base::flat_set<AnimationDriver*>& GetDriversForTesting(
-      PaintImage::Id paint_image_id) const;
+  const base::flat_set<raw_ptr<AnimationDriver, CtnExperimental>>&
+  GetDriversForTesting(PaintImage::Id paint_image_id) const;
   size_t GetLastNumOfFramesSkippedForTesting(
       PaintImage::Id paint_image_id) const;
 
@@ -166,7 +166,8 @@ class CC_EXPORT ImageAnimationController {
     base::TimeTicks next_desired_tick_time() const {
       return current_state_.next_desired_tick_time;
     }
-    const base::flat_set<AnimationDriver*>& drivers_for_testing() const {
+    const base::flat_set<raw_ptr<AnimationDriver, CtnExperimental>>&
+    drivers_for_testing() const {
       return drivers_;
     }
     size_t last_num_frames_skipped_for_testing() const {
@@ -227,7 +228,7 @@ class CC_EXPORT ImageAnimationController {
     AnimationAdvancementState current_state_;
 
     // A set of drivers interested in animating this image.
-    base::flat_set<AnimationDriver*> drivers_;
+    base::flat_set<raw_ptr<AnimationDriver, CtnExperimental>> drivers_;
 
     // The index being used on the active tree, if a recording with this image
     // is still present.

cc/trees/layer_tree_impl.h

@@ -540,7 +540,8 @@ class CC_EXPORT LayerTreeImpl {
 
   void AddLayerShouldPushProperties(LayerImpl* layer);
   void ClearLayersThatShouldPushProperties();
-  const base::flat_set<LayerImpl*>& LayersThatShouldPushProperties() const {
+  const base::flat_set<raw_ptr<LayerImpl, CtnExperimental>>&
+  LayersThatShouldPushProperties() const {
     return layers_that_should_push_properties_;
   }
 
@@ -606,8 +607,8 @@ class CC_EXPORT LayerTreeImpl {
 
   void NotifyLayerHasPaintWorkletsChanged(PictureLayerImpl* layer,
                                           bool has_worklets);
-  const base::flat_set<PictureLayerImpl*>& picture_layers_with_paint_worklets()
-      const {
+  const base::flat_set<raw_ptr<PictureLayerImpl, CtnExperimental>>&
+  picture_layers_with_paint_worklets() const {
     return picture_layers_with_paint_worklets_;
   }
 
@@ -870,7 +871,8 @@ class CC_EXPORT LayerTreeImpl {
   LayerImplMap layer_id_map_;
 
   // Set of layers that need to push properties.
-  base::flat_set<LayerImpl*> layers_that_should_push_properties_;
+  base::flat_set<raw_ptr<LayerImpl, CtnExperimental>>
+      layers_that_should_push_properties_;
 
   std::unordered_map<ElementId, float, ElementIdHash>
       element_id_to_opacity_animations_;
@@ -895,7 +897,8 @@ class CC_EXPORT LayerTreeImpl {
   // After commit (or impl-side invalidation), the LayerTreeHostImpl must walk
   // all PictureLayerImpls that have PaintWorklets to ensure they are painted.
   // To avoid unnecessary walking, we track that set here.
-  base::flat_set<PictureLayerImpl*> picture_layers_with_paint_worklets_;
+  base::flat_set<raw_ptr<PictureLayerImpl, CtnExperimental>>
+      picture_layers_with_paint_worklets_;
 
   base::flat_set<viz::SurfaceRange> surface_layer_ranges_;
 

cc/trees/layer_tree_impl_unittest.cc

@@ -2462,7 +2462,7 @@ TEST_F(LayerTreeImplTest, TrackPictureLayersWithPaintWorklets) {
                              nullptr);
 
   // The set should correctly track which layers are in it.
-  const base::flat_set<PictureLayerImpl*>& layers =
+  const base::flat_set<raw_ptr<PictureLayerImpl, CtnExperimental>>& layers =
       pending_tree->picture_layers_with_paint_worklets();
   EXPECT_EQ(layers.size(), 2u);
   EXPECT_TRUE(layers.contains(child1));

cc/trees/tree_synchronizer.cc

@@ -217,7 +217,7 @@ void TreeSynchronizer::PushLayerProperties(
   auto source_layers_end =
       commit_state.layers_that_should_push_properties.end();
   for (auto it = source_layers_begin; it != source_layers_end; ++it) {
-    auto* source_layer = *it;
+    auto* source_layer = (*it).get();
     LayerImpl* target_layer = impl_tree->LayerById(source_layer->id());
     DCHECK(target_layer);
     source_layer->PushPropertiesTo(target_layer, commit_state, unsafe_state);

chrome/browser/apps/platform_apps/app_window_registry_util.cc

@@ -80,7 +80,7 @@ void AppWindowRegistryUtil::CloseAllAppWindows() {
     // Ask each app window to close, but cater for windows removing or
     // rearranging themselves in the ordered window list in response.
     AppWindowList window_list_copy(registry->app_windows());
-    for (auto* window : window_list_copy) {
+    for (AppWindow* window : window_list_copy) {
       // Ensure window is still valid.
       if (base::Contains(registry->app_windows(), window))
         window->GetBaseWindow()->Close();

chrome/browser/ash/arc/input_overlay/arc_input_overlay_manager.h

@@ -168,7 +168,7 @@ class ArcInputOverlayManager : public KeyedService,
   // prepare or start loading the GIO default key mapping data. Once window is
   // destroying or the GIO data reading is finished, window is removed from this
   // set.
-  base::flat_set<aura::Window*> loading_data_windows_;
+  base::flat_set<raw_ptr<aura::Window, CtnExperimental>> loading_data_windows_;
   bool is_text_input_active_ = false;
   raw_ptr<ui::InputMethod> input_method_ = nullptr;
   std::unique_ptr<InputMethodObserver> input_method_observer_;

chrome/browser/ash/borealis/borealis_window_manager.cc

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "chrome/browser/ash/borealis/borealis_window_manager.h"
+#include "base/memory/raw_ptr.h"
 
 #include <string>
 
@@ -203,7 +204,9 @@ void BorealisWindowManager::HandleWindowDestruction(aura::Window* window,
     observer.OnWindowFinished(app_id, window);
   }
 
-  base::flat_map<std::string, base::flat_set<aura::Window*>>::iterator iter =
+  base::flat_map<
+      std::string,
+      base::flat_set<raw_ptr<aura::Window, CtnExperimental>>>::iterator iter =
       ids_to_windows_.find(app_id);
   DCHECK(iter != ids_to_windows_.end());
   DCHECK(iter->second.contains(window));

chrome/browser/ash/borealis/borealis_window_manager.h

@@ -146,7 +146,9 @@ class BorealisWindowManager : public apps::InstanceRegistry::Observer {
   base::ScopedObservation<apps::InstanceRegistry,
                           apps::InstanceRegistry::Observer>
       instance_registry_observation_;
-  base::flat_map<std::string, base::flat_set<aura::Window*>> ids_to_windows_;
+  base::flat_map<std::string,
+                 base::flat_set<raw_ptr<aura::Window, CtnExperimental>>>
+      ids_to_windows_;
   base::ObserverList<AnonymousAppObserver> anon_observers_;
   base::ObserverList<AppWindowLifetimeObserver> lifetime_observers_;
 };

chrome/browser/ash/extensions/external_cache_impl.cc

@@ -93,7 +93,7 @@ class ExternalCacheImpl::AnyInstallFailureObserver
                                      InstallObserver>
       install_tracker_observations_{this};
 
-  base::flat_set<Profile*> observed_profiles_;
+  base::flat_set<raw_ptr<Profile, CtnExperimental>> observed_profiles_;
 
   // Required to outlive |this|, which is guaranteed in practice by having
   // |owner_| own |this|.

chrome/browser/ash/file_system_provider/operation_request_manager.cc

@@ -72,7 +72,7 @@ bool OperationRequestManager::IsInteractingWithUser() const {
   // which is at most once every 10 seconds per request (except tests).
   const extensions::WindowControllerList::ControllerList& windows =
       extensions::WindowControllerList::GetInstance()->windows();
-  for (auto* window : windows) {
+  for (extensions::WindowController* window : windows) {
     const Browser* const browser = window->GetBrowser();
     if (!browser)
       continue;

chrome/browser/ash/login/session/user_session_manager.h

@@ -624,7 +624,8 @@ class UserSessionManager
   // Mapped to `chrome::AttemptRestart`, except in tests.
   base::RepeatingClosure attempt_restart_closure_;
 
-  base::flat_set<Profile*> user_profile_initialized_called_;
+  base::flat_set<raw_ptr<Profile, CtnExperimental>>
+      user_profile_initialized_called_;
 
   std::unique_ptr<arc::AlwaysOnVpnManager> always_on_vpn_manager_;
 

chrome/browser/ash/plugin_vm/plugin_vm_files.cc

@@ -73,7 +73,7 @@ void FocusAllPluginVmWindows() {
   if (!item_controller) {
     return;
   }
-  for (auto* app_window : item_controller->windows()) {
+  for (AppWindowBase* app_window : item_controller->windows()) {
     app_window->Activate();
   }
 }

chrome/browser/chromeos/policy/dlp/dlp_content_manager_lacros.cc

@@ -261,7 +261,7 @@ void DlpContentManagerLacros::OnWindowDestroying(aura::Window* window) {
 
 void DlpContentManagerLacros::UpdateRestrictions(aura::Window* window) {
   DlpContentRestrictionSet new_restrictions;
-  for (auto* web_contents : window_webcontents_[window]) {
+  for (content::WebContents* web_contents : window_webcontents_[window]) {
     if (web_contents->GetNativeView()->IsVisible()) {
       new_restrictions.UnionWith(confidential_web_contents_[web_contents]);
     }

chrome/browser/chromeos/policy/dlp/dlp_content_manager_lacros.h

@@ -7,6 +7,7 @@
 
 #include "base/containers/flat_map.h"
 #include "base/containers/flat_set.h"
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/chromeos/policy/dlp/dlp_content_manager.h"
 #include "chrome/browser/chromeos/policy/dlp/dlp_content_restriction_set.h"
 #include "chromeos/crosapi/mojom/dlp.mojom.h"
@@ -111,7 +112,8 @@ class DlpContentManagerLacros : public DlpContentManager,
       content::WebContents* web_contents) const override;
 
   // Tracks set of known confidential WebContents* for each Window*.
-  base::flat_map<aura::Window*, base::flat_set<content::WebContents*>>
+  base::flat_map<aura::Window*,
+                 base::flat_set<raw_ptr<content::WebContents, CtnExperimental>>>
       window_webcontents_;
 
   // Tracks current restrictions applied to Window* based on visible

chrome/browser/extensions/api/developer_private/developer_private_apitest.cc

@@ -2,6 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_refptr.h"
 #include "base/path_service.h"
@@ -98,7 +99,7 @@ IN_PROC_BROWSER_TEST_F(DeveloperPrivateApiTest, InspectAppWindowView) {
       profile());
 
   // Verify that dev tools opened.
-  std::list<AppWindow*> app_windows =
+  std::list<raw_ptr<AppWindow, CtnExperimental>> app_windows =
       AppWindowRegistry::Get(profile())->GetAppWindowsForApp(app->id());
   ASSERT_EQ(1u, app_windows.size());
   EXPECT_TRUE(DevToolsWindow::GetInstanceForInspectedWebContents(

chrome/browser/extensions/api/identity/identity_mint_queue.h

@@ -9,6 +9,7 @@
 #include <map>
 #include <set>
 
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/extensions/api/identity/extension_token_key.h"
 
 namespace extensions {
@@ -56,7 +57,8 @@ class IdentityMintRequestQueue {
              const ExtensionTokenKey& key);
 
  private:
-  typedef std::list<IdentityMintRequestQueue::Request*> RequestQueue;
+  typedef std::list<raw_ptr<IdentityMintRequestQueue::Request, CtnExperimental>>
+      RequestQueue;
   typedef std::map<const ExtensionTokenKey, RequestQueue> RequestQueueMap;
 
   RequestQueueMap& GetRequestQueueMap(IdentityMintRequestQueue::MintType type);

chrome/browser/extensions/api/notifications/notifications_api.cc

@@ -174,7 +174,7 @@ bool ShouldShowOverCurrentFullscreenWindow(Profile* profile,
   DCHECK(!extension_id.empty());
   AppWindowRegistry::AppWindowList windows =
       AppWindowRegistry::Get(profile)->GetAppWindowsForApp(extension_id);
-  for (auto* window : windows) {
+  for (AppWindow* window : windows) {
     if (window->IsFullscreen() && window->GetBaseWindow()->IsActive())
       return true;
   }

chrome/browser/extensions/api/tabs/tabs_api.cc

@@ -567,7 +567,8 @@ ExtensionFunction::ResponseAction WindowsGetAllFunction::Run() {
   ExtensionTabUtil::PopulateTabBehavior populate_tab_behavior =
       extractor.populate_tabs() ? ExtensionTabUtil::kPopulateTabs
                                 : ExtensionTabUtil::kDontPopulateTabs;
-  for (auto* controller : WindowControllerList::GetInstance()->windows()) {
+  for (WindowController* controller :
+       WindowControllerList::GetInstance()->windows()) {
     if (!controller->GetBrowser() ||
         !windows_util::CanOperateOnWindow(this, controller,
                                           extractor.type_filters())) {

chrome/browser/extensions/window_controller_list.h

@@ -7,6 +7,7 @@
 
 #include <list>
 
+#include "base/memory/raw_ptr.h"
 #include "base/memory/singleton.h"
 #include "base/observer_list.h"
 #include "chrome/browser/extensions/window_controller.h"
@@ -20,7 +21,7 @@ class WindowControllerListObserver;
 // Class to maintain a list of WindowControllers.
 class WindowControllerList {
  public:
-  typedef std::list<WindowController*> ControllerList;
+  typedef std::list<raw_ptr<WindowController, CtnExperimental>> ControllerList;
 
   WindowControllerList();
   WindowControllerList(const WindowControllerList&) = delete;

chrome/browser/extensions/window_open_apitest.cc

@@ -352,7 +352,7 @@ namespace {
 
 aura::Window* GetCurrentWindow() {
   extensions::WindowController* controller = nullptr;
-  for (auto* iter :
+  for (extensions::WindowController* iter :
        extensions::WindowControllerList::GetInstance()->windows()) {
     if (iter->window()->IsActive()) {
       controller = iter;

chrome/browser/google/google_update_win_unittest.cc

@@ -15,6 +15,7 @@
 #include "base/containers/queue.h"
 #include "base/functional/bind.h"
 #include "base/i18n/string_search.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/ref_counted.h"
 #include "base/path_service.h"
 #include "base/strings/string_util.h"
@@ -345,7 +346,7 @@ class MockApp : public CComObjectRootEx<CComSingleThreadModel>, public IAppWeb {
   }
 
   // The states returned by the MockApp when probed.
-  base::queue<CComObject<MockCurrentState>*> states_;
+  base::queue<raw_ptr<CComObject<MockCurrentState>, CtnExperimental>> states_;
 
   // A gmock sequence under which a series of get_CurrentState expectations are
   // evaluated.

chrome/browser/lacros/fullscreen_controller_client_lacros.cc

@@ -74,7 +74,7 @@ FullscreenControllerClientLacros::GetActiveAppWindowWebContents() {
 
   const auto& app_windows =
       extensions::AppWindowRegistry::Get(profile)->app_windows();
-  for (auto* app_window : app_windows) {
+  for (extensions::AppWindow* app_window : app_windows) {
     if (app_window->GetBaseWindow()->IsActive()) {
       return app_window->web_contents();
     }

chrome/browser/media/webrtc/tab_desktop_media_list.cc

@@ -169,7 +169,7 @@ void TabDesktopMediaList::Refresh(bool update_thumnails) {
     // Find all AppWindows for the given profile.
     const extensions::AppWindowRegistry::AppWindowList& window_list =
         extensions::AppWindowRegistry::Get(profile)->app_windows();
-    for (const auto* app_window : window_list) {
+    for (const extensions::AppWindow* app_window : window_list) {
       if (!app_window->is_hidden())
         contents_list.push_back(app_window->web_contents());
     }

chrome/browser/media/webrtc/webrtc_event_log_manager.h

@@ -475,7 +475,8 @@ class WebRtcEventLogManager final
   // observation. Allows us to register for each RPH only once, and get notified
   // when it exits (cleanly or due to a crash).
   // This object is only to be accessed on the UI thread.
-  base::flat_set<content::RenderProcessHost*> observed_render_process_hosts_;
+  base::flat_set<raw_ptr<content::RenderProcessHost, CtnExperimental>>
+      observed_render_process_hosts_;
 
   // In production, this holds a small object that just tells WebRTC (via
   // PeerConnectionTracker) to start/stop producing event logs for a specific

chrome/browser/metrics/usage_scenario/tab_usage_scenario_tracker.h

@@ -83,8 +83,8 @@ class TabUsageScenarioTracker : public TabStatsObserver,
       GUARDED_BY_CONTEXT(sequence_checker_);
 
   // Keep track of the WebContents currently playing video.
-  base::flat_set<content::WebContents*> contents_playing_video_
-      GUARDED_BY_CONTEXT(sequence_checker_);
+  base::flat_set<raw_ptr<content::WebContents, CtnExperimental>>
+      contents_playing_video_ GUARDED_BY_CONTEXT(sequence_checker_);
 
   // The last reading of the number of displays.
   std::optional<int> last_num_displays_;

chrome/browser/navigation_predictor/navigation_predictor_keyed_service.h

@@ -151,7 +151,8 @@ class NavigationPredictorKeyedService : public KeyedService {
   // Manages preconnecting to the user's default search engine.
   SearchEnginePreconnector search_engine_preconnector_;
 
-  std::unordered_set<content::WebContents*> visible_web_contents_;
+  std::unordered_set<raw_ptr<content::WebContents, CtnExperimental>>
+      visible_web_contents_;
 
   base::TimeTicks last_web_contents_state_change_time_;
 

chrome/browser/notifications/screen_capture_notification_blocker.h

@@ -101,7 +101,8 @@ class ScreenCaptureNotificationBlocker
 
   // Storing raw pointers here is fine because MediaStreamCaptureIndicator
   // notifies us before the WebContents is destroyed.
-  base::flat_set<content::WebContents*> capturing_web_contents_;
+  base::flat_set<raw_ptr<content::WebContents, CtnExperimental>>
+      capturing_web_contents_;
 };
 
 #endif  // CHROME_BROWSER_NOTIFICATIONS_SCREEN_CAPTURE_NOTIFICATION_BLOCKER_H_

chrome/browser/pdf/test_pdf_viewer_stream_manager.h

@@ -7,6 +7,7 @@
 
 #include "base/containers/flat_set.h"
 #include "base/functional/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "chrome/browser/pdf/pdf_viewer_stream_manager.h"
 #include "content/public/browser/web_contents_user_data.h"
 #include "testing/gtest/include/gtest/gtest.h"
@@ -82,7 +83,7 @@ class TestPdfViewerStreamManagerFactory
  private:
   // Tracks managers this factory has created. It's safe to track raw pointers,
   // since the pointers are only for comparison and aren't dereferenced.
-  base::flat_set<PdfViewerStreamManager*> managers_;
+  base::flat_set<raw_ptr<PdfViewerStreamManager, CtnExperimental>> managers_;
 };
 
 }  // namespace pdf

chrome/browser/resource_coordinator/lifecycle_unit.h

@@ -160,7 +160,8 @@ class LifecycleUnit {
   virtual ukm::SourceId GetUkmSourceId() const = 0;
 };
 
-using LifecycleUnitSet = base::flat_set<LifecycleUnit*>;
+using LifecycleUnitSet =
+    base::flat_set<raw_ptr<LifecycleUnit, CtnExperimental>>;
 using LifecycleUnitVector =
     std::vector<raw_ptr<LifecycleUnit, VectorExperimental>>;
 

chrome/browser/resource_coordinator/tab_memory_metrics_reporter_unittest.cc

@@ -74,7 +74,8 @@ class TestTabMemoryMetricsReporter : public TabMemoryMetricsReporter {
 
  private:
   unsigned emit_count_;
-  std::unordered_set<content::WebContents*> discarded_contents_;
+  std::unordered_set<raw_ptr<content::WebContents, CtnExperimental>>
+      discarded_contents_;
 };
 
 class TabMemoryMetricsReporterTest : public testing::Test {

chrome/browser/safe_browsing/download_protection/deep_scanning_browsertest.cc

@@ -322,7 +322,8 @@ class DownloadDeepScanningBrowserTestBase
     return last_request_;
   }
 
-  const base::flat_set<download::DownloadItem*>& download_items() {
+  const base::flat_set<raw_ptr<download::DownloadItem, CtnExperimental>>&
+  download_items() {
     return download_items_;
   }
 
@@ -492,7 +493,8 @@ class DownloadDeepScanningBrowserTestBase
   base::OnceClosure waiting_for_upload_closure_;
   base::OnceClosure waiting_for_metadata_closure_;
 
-  base::flat_set<download::DownloadItem*> download_items_;
+  base::flat_set<raw_ptr<download::DownloadItem, CtnExperimental>>
+      download_items_;
 
   std::unique_ptr<policy::MockCloudPolicyClient> client_;
   std::unique_ptr<signin::IdentityTestEnvironment> identity_test_environment_;

chrome/browser/sessions/exit_type_service.cc

@@ -108,7 +108,7 @@ class ExitTypeService::BrowserTabObserverImpl : public BrowserListObserver,
   raw_ptr<ExitTypeService> service_;
 
   // Browsers whose TabStripModel this is observing.
-  base::flat_set<Browser*> browsers_;
+  base::flat_set<raw_ptr<Browser, CtnExperimental>> browsers_;
 };
 
 ExitTypeService::CrashedLock::~CrashedLock() {

chrome/browser/sessions/tab_loader.h

@@ -96,7 +96,7 @@ class TabLoader : public base::RefCounted<TabLoader>,
   };
 
   using LoadingTabSet = base::flat_set<LoadingTab>;
-  using TabSet = base::flat_set<content::WebContents*>;
+  using TabSet = base::flat_set<raw_ptr<content::WebContents, CtnExperimental>>;
   using TabVector = std::vector<std::pair<float, content::WebContents*>>;
 
   TabLoader();

chrome/browser/sessions/tab_loader_unittest.cc

@@ -8,6 +8,7 @@
 
 #include "base/containers/flat_set.h"
 #include "base/functional/bind.h"
+#include "base/memory/raw_ptr.h"
 #include "base/run_loop.h"
 #include "base/test/simple_test_tick_clock.h"
 #include "base/time/time.h"
@@ -159,10 +160,11 @@ class TabLoaderTest : public BrowserWithTestWindowTest {
 
     // Copy because the set can change while calling
     // SimulatePrimaryPageChanged() and the iteration is invalidated.
-    base::flat_set<content::WebContents*> load_initiated =
-        tab_loader_.tabs_load_initiated();
-    for (auto* web_contents : load_initiated)
+    base::flat_set<raw_ptr<content::WebContents, CtnExperimental>>
+        load_initiated = tab_loader_.tabs_load_initiated();
+    for (content::WebContents* web_contents : load_initiated) {
       SimulatePrimaryPageChanged(web_contents);
+    }
   }
 
   void StartTabLoader() {

chrome/browser/task_manager/providers/web_contents/web_contents_task_provider.cc

@@ -100,7 +100,7 @@ class WebContentsTaskProvider::WebContentsEntry
   // only as per FindLocalRoot()), and its RendererTask. The number of tracked
   // items is small, thus flat_map and flat_set.
   struct SiteInstanceInfo {
-    base::flat_set<RenderFrameHost*> frames;
+    base::flat_set<raw_ptr<RenderFrameHost, CtnExperimental>> frames;
     std::unique_ptr<RendererTask> renderer_task;
   };
   base::flat_map<SiteInstance*, SiteInstanceInfo> site_instance_infos_;
@@ -474,7 +474,7 @@ void WebContentsTaskProvider::WebContentsEntry::ClearTaskForFrame(
 
   bool only_bfcache_or_prerender_rfhs = true;
   for (auto& [ignore, site_instance_info] : site_instance_infos_) {
-    for (auto* rfh : site_instance_info.frames) {
+    for (RenderFrameHost* rfh : site_instance_info.frames) {
       const auto state = rfh->GetLifecycleState();
       if (state != RenderFrameHost::LifecycleState::kInBackForwardCache &&
           state != RenderFrameHost::LifecycleState::kPrerendering) {

chrome/browser/ui/ash/shelf/app_service/app_service_app_window_crostini_tracker.h

@@ -63,7 +63,8 @@ class AppServiceAppWindowCrostiniTracker {
 
   // Windows that have been granted the permission to activate via the
   // exo::Permission window property.
-  base::flat_set<aura::Window*> activation_permissions_;
+  base::flat_set<raw_ptr<aura::Window, CtnExperimental>>
+      activation_permissions_;
 };
 
 #endif  // CHROME_BROWSER_UI_ASH_SHELF_APP_SERVICE_APP_SERVICE_APP_WINDOW_CROSTINI_TRACKER_H_

chrome/browser/ui/ash/shelf/app_window_shelf_item_controller.cc

@@ -3,6 +3,7 @@
 // found in the LICENSE file.
 
 #include "chrome/browser/ui/ash/shelf/app_window_shelf_item_controller.h"
+#include "base/memory/raw_ptr.h"
 
 #include <iterator>
 #include <utility>
@@ -63,15 +64,16 @@ ash::ShelfAction ActivateOrAdvanceToNextAppWindow(
 
 // Launches a new lacros window if there isn't already one on the active desk,
 // or the icon is clicked with CTRL.
-bool ShouldLaunchNewLacrosWindow(const ui::Event& event,
-                                 const std::list<AppWindowBase*>& app_windows) {
+bool ShouldLaunchNewLacrosWindow(
+    const ui::Event& event,
+    const std::list<raw_ptr<AppWindowBase, CtnExperimental>>& app_windows) {
   // If the icon is clicked with holding the CTRL, launch a new window.
   if (event.IsControlDown())
     return true;
 
   // Do not launch a new window if there is already a lacros window on the
   // current desk.
-  for (auto* window : app_windows) {
+  for (AppWindowBase* window : app_windows) {
     aura::Window* aura_window = window->GetNativeWindow();
     if (crosapi::browser_util::IsLacrosWindow(aura_window) &&
         chromeos::DesksHelper::Get(aura_window)
@@ -91,11 +93,13 @@ AppWindowShelfItemController::AppWindowShelfItemController(
 
 AppWindowShelfItemController::~AppWindowShelfItemController() {
   WindowList windows(windows_);
-  for (auto* window : hidden_windows_)
+  for (AppWindowBase* window : hidden_windows_) {
     windows.push_back(window);
+  }
 
-  for (auto* window : windows)
+  for (AppWindowBase* window : windows) {
     window->SetController(nullptr);
+  }
 }
 
 void AppWindowShelfItemController::AddWindow(AppWindowBase* app_window) {
@@ -167,7 +171,7 @@ void AppWindowShelfItemController::ItemSelected(
     ItemSelectedCallback callback,
     const ItemFilterPredicate& filter_predicate) {
   WindowList filtered_windows;
-  for (auto* window : windows_) {
+  for (AppWindowBase* window : windows_) {
     if (filter_predicate.is_null() ||
         filter_predicate.Run(window->GetNativeWindow())) {
       filtered_windows.push_back(window);
@@ -199,7 +203,7 @@ void AppWindowShelfItemController::ItemSelected(
   }
 
   AppWindowBase* window_to_show =
-      last_active ? last_active : filtered_windows.front();
+      last_active ? last_active : filtered_windows.front().get();
   // If the event was triggered by a keystroke, we try to advance to the next
   // item if the window we are trying to activate is already active.
   ash::ShelfAction action = ash::SHELF_ACTION_NONE;
@@ -228,7 +232,7 @@ AppWindowShelfItemController::GetAppMenuItems(
   std::u16string app_title = ShelfControllerHelper::GetAppTitle(
       ChromeShelfController::instance()->profile(), app_id());
   int command_id = -1;
-  for (const auto* it : windows()) {
+  for (const AppWindowBase* it : windows()) {
     ++command_id;
     aura::Window* window = it->GetNativeWindow();
     // Can window be null?
@@ -264,10 +268,12 @@ void AppWindowShelfItemController::GetContextMenu(
 }
 
 void AppWindowShelfItemController::Close() {
-  for (auto* window : windows_)
+  for (AppWindowBase* window : windows_) {
     window->Close();
-  for (auto* window : hidden_windows_)
+  }
+  for (AppWindowBase* window : hidden_windows_) {
     window->Close();
+  }
 }
 
 void AppWindowShelfItemController::ActivateIndexedApp(size_t index) {

chrome/browser/ui/ash/shelf/app_window_shelf_item_controller.h

@@ -26,7 +26,7 @@ class ShelfContextMenu;
 class AppWindowShelfItemController : public ash::ShelfItemDelegate,
                                      public aura::WindowObserver {
  public:
-  using WindowList = std::list<AppWindowBase*>;
+  using WindowList = std::list<raw_ptr<AppWindowBase, CtnExperimental>>;
 
   explicit AppWindowShelfItemController(const ash::ShelfID& shelf_id);
 

chrome/browser/ui/browser_list.h

@@ -35,7 +35,7 @@ class BrowserListObserver;
 // Maintains a list of Browser objects.
 class BrowserList {
  public:
-  using BrowserSet = base::flat_set<Browser*>;
+  using BrowserSet = base::flat_set<raw_ptr<Browser, CtnExperimental>>;
   using BrowserVector = std::vector<raw_ptr<Browser, VectorExperimental>>;
   using CloseCallback = base::RepeatingCallback<void(const base::FilePath&)>;
   using const_iterator = BrowserVector::const_iterator;

chrome/browser/ui/page_info/chrome_page_info_ui_delegate.cc

@@ -171,7 +171,7 @@ bool ChromePageInfoUiDelegate::IsMultipleTabsOpen() {
       extensions::WindowControllerList::GetInstance()->windows();
   int count = 0;
   auto site_origin = site_url_.DeprecatedGetOriginAsURL();
-  for (auto* window : windows) {
+  for (extensions::WindowController* window : windows) {
     const Browser* const browser = window->GetBrowser();
     if (!browser)
       continue;

chrome/browser/ui/views/extensions/extensions_menu_test_util.cc

@@ -242,7 +242,7 @@ gfx::Size ExtensionsMenuTestUtil::GetMaxAvailableSizeToFitBubbleOnScreen(
 
 ExtensionMenuItemView* ExtensionsMenuTestUtil::GetMenuItemViewForId(
     const extensions::ExtensionId& id) {
-  base::flat_set<ExtensionMenuItemView*> menu_items;
+  base::flat_set<raw_ptr<ExtensionMenuItemView, CtnExperimental>> menu_items;
   if (base::FeatureList::IsEnabled(
           extensions_features::kExtensionsMenuAccessControl)) {
     ExtensionsMenuMainPageView* main_page =
@@ -250,7 +250,8 @@ ExtensionMenuItemView* ExtensionsMenuTestUtil::GetMenuItemViewForId(
             ->GetControllerForTesting()
             ->GetMainPageViewForTesting();
     DCHECK(main_page);
-    menu_items = main_page->GetMenuItems();
+    auto items = main_page->GetMenuItems();
+    menu_items = {items.begin(), items.end()};
 
   } else {
     menu_items = menu_view_->extensions_menu_items_for_testing();

chrome/browser/ui/views/extensions/extensions_menu_view.cc

@@ -475,7 +475,7 @@ void ExtensionsMenuView::OnToolbarModelInitialized() {
 }
 
 void ExtensionsMenuView::OnToolbarPinnedActionsChanged() {
-  for (auto* menu_item : extensions_menu_items_) {
+  for (ExtensionMenuItemView* menu_item : extensions_menu_items_) {
     extensions::ExtensionId extension_id =
         GetAsMenuItemView(menu_item)->view_controller()->GetId();
     bool is_force_pinned =

chrome/browser/ui/views/extensions/extensions_menu_view.h

@@ -88,7 +88,8 @@ class ExtensionsMenuView : public views::BubbleDialogDelegateView,
   void OnToolbarModelInitialized() override;
   void OnToolbarPinnedActionsChanged() override;
 
-  base::flat_set<ExtensionMenuItemView*> extensions_menu_items_for_testing() {
+  base::flat_set<raw_ptr<ExtensionMenuItemView, CtnExperimental>>
+  extensions_menu_items_for_testing() {
     return extensions_menu_items_;
   }
   views::Button* manage_extensions_button_for_testing() {
@@ -165,7 +166,8 @@ class ExtensionsMenuView : public views::BubbleDialogDelegateView,
 
   // A collection of all menu item views in the menu. Note that this is
   // *unordered*, since the menu puts extensions into different sections.
-  base::flat_set<ExtensionMenuItemView*> extensions_menu_items_;
+  base::flat_set<raw_ptr<ExtensionMenuItemView, CtnExperimental>>
+      extensions_menu_items_;
 
   raw_ptr<views::LabelButton> manage_extensions_button_ = nullptr;
 

chrome/browser/ui/views/extensions/extensions_menu_view_interactive_uitest.cc

@@ -7,6 +7,7 @@
 #include <algorithm>
 #include <optional>
 
+#include "base/memory/raw_ptr.h"
 #include "base/ranges/algorithm.h"
 #include "base/test/metrics/histogram_tester.h"
 #include "build/build_config.h"
@@ -58,7 +59,8 @@ using ::testing::ElementsAre;
 
 class ExtensionsMenuViewInteractiveUITest : public ExtensionsToolbarUITest {
  public:
-  static base::flat_set<ExtensionMenuItemView*> GetExtensionMenuItemViews() {
+  static base::flat_set<raw_ptr<ExtensionMenuItemView, CtnExperimental>>
+  GetExtensionMenuItemViews() {
     return ExtensionsMenuView::GetExtensionsMenuViewForTesting()
         ->extensions_menu_items_for_testing();
   }

chrome/browser/ui/views/extensions/extensions_menu_view_unittest.cc

@@ -128,7 +128,7 @@ ExtensionsMenuViewUnitTest::InstallExtensionAndLayout(const std::string& name) {
 }
 
 ExtensionMenuItemView* ExtensionsMenuViewUnitTest::GetOnlyMenuItem() {
-  base::flat_set<ExtensionMenuItemView*> menu_items =
+  base::flat_set<raw_ptr<ExtensionMenuItemView, CtnExperimental>> menu_items =
       extensions_menu()->extensions_menu_items_for_testing();
   if (menu_items.size() != 1u) {
     ADD_FAILURE() << "Not exactly one item; size is: " << menu_items.size();
@@ -172,7 +172,7 @@ ExtensionsMenuViewUnitTest::GetPinnedExtensionViews() {
 
 ExtensionMenuItemView* ExtensionsMenuViewUnitTest::GetExtensionMenuItemView(
     const std::string& name) {
-  base::flat_set<ExtensionMenuItemView*> menu_items =
+  base::flat_set<raw_ptr<ExtensionMenuItemView, CtnExperimental>> menu_items =
       extensions_menu()->extensions_menu_items_for_testing();
   auto iter =
       base::ranges::find(menu_items, name, [](ExtensionMenuItemView* item) {
@@ -201,7 +201,7 @@ TEST_F(ExtensionsMenuViewUnitTest, ExtensionsAreShownInTheMenu) {
   InstallExtensionAndLayout(kExtensionName);
 
   {
-    base::flat_set<ExtensionMenuItemView*> menu_items =
+    base::flat_set<raw_ptr<ExtensionMenuItemView, CtnExperimental>> menu_items =
         extensions_menu()->extensions_menu_items_for_testing();
     ASSERT_EQ(1u, menu_items.size());
     EXPECT_EQ(kExtensionName,
@@ -312,7 +312,7 @@ TEST_F(ExtensionsMenuViewUnitTest, PinnedExtensionRemovedWhenDisabled) {
 TEST_F(ExtensionsMenuViewUnitTest, PinnedExtensionLayout) {
   for (int i = 0; i < 3; i++)
     InstallExtensionAndLayout(base::StringPrintf("Test %d", i));
-  for (auto* menu_item :
+  for (ExtensionMenuItemView* menu_item :
        extensions_menu()->extensions_menu_items_for_testing()) {
     ClickPinButton(menu_item);
   }

chrome/browser/ui/views/frame/picture_in_picture_browser_frame_view.h

@@ -307,7 +307,8 @@ class PictureInPictureBrowserFrameView
         child_dialog_observations_{this};
 
     // Tracks child dialogs that have not yet been shown.
-    base::flat_set<views::Widget*> invisible_child_dialogs_;
+    base::flat_set<raw_ptr<views::Widget, CtnExperimental>>
+        invisible_child_dialogs_;
 
     // The bounds that we forced the window to be in response to a child dialog
     // opening.

chrome/browser/ui/webui/signin/login_ui_service.h

@@ -105,7 +105,7 @@ class LoginUIService : public KeyedService {
 
  private:
   // Weak pointers to the recently opened UIs, with the most recent in front.
-  std::list<LoginUI*> ui_list_;
+  std::list<raw_ptr<LoginUI, CtnExperimental>> ui_list_;
 #if !BUILDFLAG(IS_CHROMEOS_ASH)
   raw_ptr<Profile> profile_;
   SigninUIError last_login_error_ = SigninUIError::Ok();

chrome/installer/util/work_item_list.h

@@ -16,6 +16,7 @@
 
 #include "base/files/file_path.h"
 #include "base/functional/callback_forward.h"
+#include "base/memory/raw_ptr.h"
 #include "chrome/installer/util/work_item.h"
 
 // A WorkItem subclass that recursively contains a list of WorkItems. Thus it
@@ -122,7 +123,7 @@ class WorkItemList : public WorkItem {
  protected:
   friend class WorkItem;
 
-  typedef std::list<WorkItem*> WorkItems;
+  typedef std::list<raw_ptr<WorkItem, CtnExperimental>> WorkItems;
   typedef WorkItems::iterator WorkItemIterator;
 
   WorkItemList();

chrome/services/sharing/nearby/platform/wifi_lan_medium.h

@@ -10,6 +10,7 @@
 #include <string>
 
 #include "base/containers/flat_set.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "chrome/services/sharing/nearby/platform/wifi_lan_server_socket.h"
 #include "chrome/services/sharing/nearby/platform/wifi_lan_socket.h"
@@ -187,8 +188,10 @@ class WifiLanMedium : public api::WifiLanMedium {
 
   // Track all pending connect/listen tasks in case Close() is called while
   // waiting.
-  base::flat_set<base::WaitableEvent*> pending_connect_waitable_events_;
-  base::flat_set<base::WaitableEvent*> pending_listen_waitable_events_;
+  base::flat_set<raw_ptr<base::WaitableEvent, CtnExperimental>>
+      pending_connect_waitable_events_;
+  base::flat_set<raw_ptr<base::WaitableEvent, CtnExperimental>>
+      pending_listen_waitable_events_;
 };
 
 }  // namespace chrome

chrome/services/sharing/nearby/platform/wifi_lan_server_socket.h

@@ -10,6 +10,7 @@
 #include <string>
 
 #include "base/containers/flat_set.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/scoped_refptr.h"
 #include "chrome/services/sharing/nearby/platform/wifi_lan_socket.h"
 #include "chromeos/ash/services/nearby/public/mojom/firewall_hole.mojom.h"
@@ -112,7 +113,8 @@ class WifiLanServerSocket : public api::WifiLanServerSocket {
   mojo::SharedRemote<sharing::mojom::FirewallHole> firewall_hole_;
 
   // Track all pending accept tasks in case Close() is called while waiting.
-  base::flat_set<base::WaitableEvent*> pending_accept_waitable_events_;
+  base::flat_set<raw_ptr<base::WaitableEvent, CtnExperimental>>
+      pending_accept_waitable_events_;
 };
 
 }  // namespace chrome

chrome/test/chromedriver/chrome/devtools_client_impl.h

@@ -221,11 +221,14 @@ class DevToolsClientImpl : public DevToolsClient {
   // For child sessions, it's the session id.
   const std::string id_;
   ParserFunc parser_func_;
-  std::list<DevToolsEventListener*> listeners_;
-  std::list<DevToolsEventListener*> unnotified_connect_listeners_;
-  std::list<DevToolsEventListener*> unnotified_event_listeners_;
+  std::list<raw_ptr<DevToolsEventListener, CtnExperimental>> listeners_;
+  std::list<raw_ptr<DevToolsEventListener, CtnExperimental>>
+      unnotified_connect_listeners_;
+  std::list<raw_ptr<DevToolsEventListener, CtnExperimental>>
+      unnotified_event_listeners_;
   raw_ptr<const InspectorEvent> unnotified_event_ = nullptr;
-  std::list<DevToolsEventListener*> unnotified_cmd_response_listeners_;
+  std::list<raw_ptr<DevToolsEventListener, CtnExperimental>>
+      unnotified_cmd_response_listeners_;
   scoped_refptr<ResponseInfo> unnotified_cmd_response_info_;
   std::map<int, scoped_refptr<ResponseInfo>> response_info_map_;
   int next_id_ = 1;  // The id identifying a particular request.

chrome/test/chromedriver/chrome/stub_devtools_client.h

@@ -9,6 +9,7 @@
 #include <memory>
 #include <string>
 
+#include "base/memory/raw_ptr.h"
 #include "chrome/test/chromedriver/chrome/devtools_client.h"
 
 class Status;
@@ -81,7 +82,7 @@ class StubDevToolsClient : public DevToolsClient {
   const std::string id_;
   std::string session_id_;
   std::string tunnel_session_id_;
-  std::list<DevToolsEventListener*> listeners_;
+  std::list<raw_ptr<DevToolsEventListener, CtnExperimental>> listeners_;
   raw_ptr<WebViewImpl> owner_ = nullptr;
   bool is_connected_ = false;
 };

chromeos/ash/components/nearby/presence/nearby_presence_service_impl.cc

@@ -216,7 +216,7 @@ void NearbyPresenceServiceImpl::Shutdown() {
 
 void NearbyPresenceServiceImpl::OnDeviceFound(mojom::PresenceDevicePtr device) {
   auto build_device = BuildPresenceDevice(std::move(device));
-  for (auto* delegate : scan_delegate_set_) {
+  for (ScanDelegate* delegate : scan_delegate_set_) {
     delegate->OnPresenceDeviceFound(build_device);
   }
 }
@@ -224,14 +224,14 @@ void NearbyPresenceServiceImpl::OnDeviceFound(mojom::PresenceDevicePtr device) {
 void NearbyPresenceServiceImpl::OnDeviceChanged(
     mojom::PresenceDevicePtr device) {
   auto build_device = BuildPresenceDevice(std::move(device));
-  for (auto* delegate : scan_delegate_set_) {
+  for (ScanDelegate* delegate : scan_delegate_set_) {
     delegate->OnPresenceDeviceChanged(build_device);
   }
 }
 
 void NearbyPresenceServiceImpl::OnDeviceLost(mojom::PresenceDevicePtr device) {
   auto build_device = BuildPresenceDevice(std::move(device));
-  for (auto* delegate : scan_delegate_set_) {
+  for (ScanDelegate* delegate : scan_delegate_set_) {
     delegate->OnPresenceDeviceLost(build_device);
   }
 }

chromeos/ash/components/nearby/presence/nearby_presence_service_impl.h

@@ -109,7 +109,7 @@ class NearbyPresenceServiceImpl
 
   mojo::Receiver<::ash::nearby::presence::mojom::ScanObserver> scan_observer_{
       this};
-  base::flat_set<ScanDelegate*> scan_delegate_set_;
+  base::flat_set<raw_ptr<ScanDelegate, CtnExperimental>> scan_delegate_set_;
 
   base::WeakPtrFactory<NearbyPresenceServiceImpl> weak_ptr_factory_{this};
 };

components/affiliations/core/browser/fake_affiliation_fetcher.h

@@ -73,7 +73,8 @@ class FakeAffiliationFetcherFactory : public AffiliationFetcherFactory {
 
  private:
   // Fakes created by this factory.
-  base::queue<FakeAffiliationFetcher*> pending_fetchers_;
+  base::queue<raw_ptr<FakeAffiliationFetcher, CtnExperimental>>
+      pending_fetchers_;
 };
 
 }  // namespace affiliations

components/bookmarks/browser/titled_url_index.h

@@ -17,6 +17,7 @@
 
 #include "base/containers/flat_set.h"
 #include "base/feature_list.h"
+#include "base/memory/raw_ptr.h"
 #include "components/bookmarks/browser/titled_url_node_sorter.h"
 #include "components/query_parser/query_parser.h"
 
@@ -33,7 +34,8 @@ struct TitledUrlMatch;
 // TitledUrlNodes that contain that string in their title or URL.
 class TitledUrlIndex {
  public:
-  using TitledUrlNodeSet = base::flat_set<const TitledUrlNode*>;
+  using TitledUrlNodeSet =
+      base::flat_set<raw_ptr<const TitledUrlNode, CtnExperimental>>;
 
   // Constructs a TitledUrlIndex. |sorter| is used to construct a sorted list
   // of matches when matches are returned from the index. If null, matches are
@@ -76,7 +78,8 @@ class TitledUrlIndex {
  private:
   friend class TitledUrlIndexFake;
 
-  using TitledUrlNodes = std::vector<const TitledUrlNode*>;
+  using TitledUrlNodes =
+      std::vector<raw_ptr<const TitledUrlNode, CtnExperimental>>;
   using Index = std::map<std::u16string, TitledUrlNodeSet>;
 
   // Constructs |sorted_nodes| by copying the matches in |matches| and sorting

components/bookmarks/browser/titled_url_node_sorter.h

@@ -8,6 +8,7 @@
 #include <vector>
 
 #include "base/containers/flat_set.h"
+#include "base/memory/raw_ptr.h"
 
 namespace bookmarks {
 
@@ -15,8 +16,10 @@ class TitledUrlNode;
 
 class TitledUrlNodeSorter {
  public:
-  using TitledUrlNodes = std::vector<const TitledUrlNode*>;
-  using TitledUrlNodeSet = base::flat_set<const TitledUrlNode*>;
+  using TitledUrlNodes =
+      std::vector<raw_ptr<const TitledUrlNode, CtnExperimental>>;
+  using TitledUrlNodeSet =
+      base::flat_set<raw_ptr<const TitledUrlNode, CtnExperimental>>;
 
   virtual ~TitledUrlNodeSorter() {}
 

components/bookmarks/browser/typed_count_sorter.cc

@@ -58,7 +58,7 @@ void TypedCountSorter::SortMatches(const TitledUrlNodeSet& matches,
   if (client_->SupportsTypedCountForUrls()) {
     UrlNodeMap url_node_map;
     UrlTypedCountMap url_typed_count_map;
-    for (auto* node : matches) {
+    for (const TitledUrlNode* node : matches) {
       const GURL& url = node->GetTitledUrlNodeUrl();
       url_node_map.insert(std::make_pair(&url, node));
       url_typed_count_map.insert(std::make_pair(&url, 0));

components/bookmarks/browser/uuid_index.h

@@ -7,6 +7,7 @@
 
 #include <unordered_set>
 
+#include "base/memory/raw_ptr.h"
 #include "base/uuid.h"
 
 namespace bookmarks {
@@ -44,7 +45,9 @@ class NodeUuidHash {
 };
 
 using UuidIndex =
-    std::unordered_set<const BookmarkNode*, NodeUuidHash, NodeUuidEquality>;
+    std::unordered_set<raw_ptr<const BookmarkNode, CtnExperimental>,
+                       NodeUuidHash,
+                       NodeUuidEquality>;
 
 }  // namespace bookmarks
 

components/exo/wayland/zaura_output_manager_v2.h

@@ -82,7 +82,7 @@ class AuraOutputManagerV2 {
                                   wl_resource* manager_resource);
 
   // A set of resources for clients bound to the aura output manager global.
-  std::unordered_set<wl_resource*> manager_resources_;
+  std::unordered_set<raw_ptr<wl_resource, CtnExperimental>> manager_resources_;
 
   // Gets the currently active outputs tracked by the server.
   const ActiveOutputGetter active_output_getter_;

components/global_media_controls/media_item_manager_impl.cc

@@ -84,7 +84,7 @@ void MediaItemManagerImpl::SetDialogDelegate(MediaDialogDelegate* delegate) {
   for (const std::string& id : item_ids) {
     ShowMediaItemUI(id);
   }
-  for (auto* item_producer : item_producers_) {
+  for (MediaItemProducer* item_producer : item_producers_) {
     item_producer->OnDialogDisplayed();
   }
   media_message_center::RecordConcurrentNotificationCount(item_ids.size());
@@ -118,7 +118,7 @@ bool MediaItemManagerImpl::HasActiveItems() {
 }
 
 bool MediaItemManagerImpl::HasFrozenItems() {
-  for (auto* item_producer : item_producers_) {
+  for (MediaItemProducer* item_producer : item_producers_) {
     if (item_producer->HasFrozenItems()) {
       return true;
     }
@@ -133,7 +133,7 @@ bool MediaItemManagerImpl::HasOpenDialog() {
 std::list<std::string> MediaItemManagerImpl::GetActiveItemIds() {
   // Get all the active item IDs and remove duplicates.
   std::set<std::string> item_ids;
-  for (auto* item_producer : item_producers_) {
+  for (MediaItemProducer* item_producer : item_producers_) {
     const std::set<std::string>& ids =
         item_producer->GetActiveControllableItemIds();
     item_ids.insert(ids.begin(), ids.end());
@@ -172,7 +172,7 @@ bool MediaItemManagerImpl::ShowMediaItemUI(const std::string& id) {
 
 base::WeakPtr<media_message_center::MediaNotificationItem>
 MediaItemManagerImpl::GetItem(const std::string& id) {
-  for (auto* producer : item_producers_) {
+  for (MediaItemProducer* producer : item_producers_) {
     auto item = producer->GetMediaItem(id);
     if (item) {
       return item;
@@ -183,7 +183,7 @@ MediaItemManagerImpl::GetItem(const std::string& id) {
 
 MediaItemProducer* MediaItemManagerImpl::GetItemProducer(
     const std::string& item_id) {
-  for (auto* producer : item_producers_) {
+  for (MediaItemProducer* producer : item_producers_) {
     if (producer->GetMediaItem(item_id)) {
       return producer;
     }

components/global_media_controls/media_item_manager_impl.h

@@ -76,7 +76,7 @@ class COMPONENT_EXPORT(GLOBAL_MEDIA_CONTROLS) MediaItemManagerImpl
   bool dialog_opened_for_single_item_ = false;
 
   // Pointers to all item producers used by |this|.
-  base::flat_set<MediaItemProducer*> item_producers_;
+  base::flat_set<raw_ptr<MediaItemProducer, CtnExperimental>> item_producers_;
 
   base::ObserverList<MediaItemManagerObserver> observers_;
 

components/heap_profiling/multi_process/client_connection_manager.h

@@ -10,6 +10,7 @@
 #include "base/functional/callback_forward.h"
 #include "base/functional/callback_helpers.h"
 #include "base/gtest_prod_util.h"
+#include "base/memory/raw_ptr.h"
 #include "base/memory/weak_ptr.h"
 #include "base/scoped_multi_source_observation.h"
 #include "content/public/browser/browser_child_process_observer.h"
@@ -140,7 +141,7 @@ class ClientConnectionManager
   // profiling - it does not reflect whether a renderer is currently still being
   // profiled. That information is only known by the profiling service, and for
   // simplicity, it's easier to just track this variable in this process.
-  std::unordered_set<void*> profiled_renderers_;
+  std::unordered_set<raw_ptr<void, CtnExperimental>> profiled_renderers_;
 };
 
 }  // namespace heap_profiling

components/history/core/browser/expire_history_backend.h

@@ -302,7 +302,7 @@ class ExpireHistoryBackend {
   // Work queue for periodic expiration tasks, used by DoExpireIteration() to
   // determine what to do at an iteration, as well as populate it for future
   // iterations.
-  base::queue<const ExpiringVisitsReader*> work_queue_;
+  base::queue<raw_ptr<const ExpiringVisitsReader, CtnExperimental>> work_queue_;
 
   // Readers for various types of visits.
   // TODO(dglazkov): If you are adding another one, please consider reorganizing

components/page_load_metrics/renderer/page_timing_metrics_sender.cc

@@ -324,7 +324,7 @@ void PageTimingMetricsSender::EnsureSendTimer(bool urgent) {
 void PageTimingMetricsSender::SendNow() {
   have_sent_ipc_ = true;
   std::vector<mojom::ResourceDataUpdatePtr> resources;
-  for (auto* resource : modified_resources_) {
+  for (PageResourceDataUse* resource : modified_resources_) {
     resources.push_back(resource->GetResourceDataUpdate());
     if (resource->IsFinishedLoading()) {
       page_resource_data_use_.erase(resource->resource_id());

components/page_load_metrics/renderer/page_timing_metrics_sender.h

@@ -9,6 +9,7 @@
 
 #include "base/containers/flat_set.h"
 #include "base/containers/small_map.h"
+#include "base/memory/raw_ptr.h"
 #include "components/page_load_metrics/common/page_load_metrics.mojom-forward.h"
 #include "components/page_load_metrics/common/page_load_timing.h"
 #include "components/page_load_metrics/renderer/page_resource_data_use.h"
@@ -156,7 +157,8 @@ class PageTimingMetricsSender {
 
   // Set of all resources that have completed or received a transfer
   // size update since the last timimg update.
-  base::flat_set<PageResourceDataUse*> modified_resources_;
+  base::flat_set<raw_ptr<PageResourceDataUse, CtnExperimental>>
+      modified_resources_;
 
   // Field trial for alternating page timing metrics sender buffer timer delay.
   // https://crbug.com/847269.

components/performance_manager/decorators/page_load_tracker_decorator.cc

@@ -339,8 +339,9 @@ void PageLoadTrackerDecorator::ScheduleDelayedUpdateLoadIdleStatePage(
 
 void PageLoadTrackerDecorator::UpdateLoadIdleStateProcess(
     ProcessNodeImpl* process_node) {
-  for (auto* frame_node : process_node->frame_nodes())
+  for (FrameNodeImpl* frame_node : process_node->frame_nodes()) {
     UpdateLoadIdleStateFrame(frame_node);
+  }
 }
 
 // static

components/performance_manager/execution_context/execution_context_registry_impl.h

@@ -5,6 +5,7 @@
 #ifndef COMPONENTS_PERFORMANCE_MANAGER_EXECUTION_CONTEXT_EXECUTION_CONTEXT_REGISTRY_IMPL_H_
 #define COMPONENTS_PERFORMANCE_MANAGER_EXECUTION_CONTEXT_EXECUTION_CONTEXT_REGISTRY_IMPL_H_
 
+#include "base/memory/raw_ptr.h"
 #include "base/observer_list.h"
 #include "base/sequence_checker.h"
 #include "components/performance_manager/public/execution_context/execution_context_registry.h"
@@ -87,7 +88,7 @@ class ExecutionContextRegistryImpl
     bool operator()(const ExecutionContext* ec1,
                     const ExecutionContext* ec2) const;
   };
-  std::unordered_set<const ExecutionContext*,
+  std::unordered_set<raw_ptr<const ExecutionContext, CtnExperimental>,
                      ExecutionContextHash,
                      ExecutionContextKeyEqual>
       execution_contexts_ GUARDED_BY_CONTEXT(sequence_checker_);

components/performance_manager/graph/frame_node_impl.cc

@@ -8,6 +8,7 @@
 
 #include "base/containers/contains.h"
 #include "base/functional/bind.h"
+#include "base/memory/raw_ptr.h"
 #include "components/performance_manager/graph/graph_impl.h"
 #include "components/performance_manager/graph/graph_impl_util.h"
 #include "components/performance_manager/graph/initializing_frame_node_observer.h"
@@ -283,24 +284,26 @@ int FrameNodeImpl::render_frame_id() const {
   return render_frame_id_;
 }
 
-const base::flat_set<FrameNodeImpl*>& FrameNodeImpl::child_frame_nodes() const {
+const base::flat_set<raw_ptr<FrameNodeImpl, CtnExperimental>>&
+FrameNodeImpl::child_frame_nodes() const {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   return child_frame_nodes_;
 }
 
-const base::flat_set<PageNodeImpl*>& FrameNodeImpl::opened_page_nodes() const {
+const base::flat_set<raw_ptr<PageNodeImpl, CtnExperimental>>&
+FrameNodeImpl::opened_page_nodes() const {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   return opened_page_nodes_;
 }
 
-const base::flat_set<PageNodeImpl*>& FrameNodeImpl::embedded_page_nodes()
-    const {
+const base::flat_set<raw_ptr<PageNodeImpl, CtnExperimental>>&
+FrameNodeImpl::embedded_page_nodes() const {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   return embedded_page_nodes_;
 }
 
-const base::flat_set<WorkerNodeImpl*>& FrameNodeImpl::child_worker_nodes()
-    const {
+const base::flat_set<raw_ptr<WorkerNodeImpl, CtnExperimental>>&
+FrameNodeImpl::child_worker_nodes() const {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
   return child_worker_nodes_;
 }
@@ -516,7 +519,7 @@ const ProcessNode* FrameNodeImpl::GetProcessNode() const {
 bool FrameNodeImpl::VisitChildFrameNodes(
     const FrameNodeVisitor& visitor) const {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  for (auto* frame_impl : child_frame_nodes()) {
+  for (FrameNodeImpl* frame_impl : child_frame_nodes()) {
     const FrameNode* frame = frame_impl;
     if (!visitor(frame)) {
       return false;
@@ -534,7 +537,7 @@ const base::flat_set<const FrameNode*> FrameNodeImpl::GetChildFrameNodes()
 
 bool FrameNodeImpl::VisitOpenedPageNodes(const PageNodeVisitor& visitor) const {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  for (auto* page_impl : opened_page_nodes()) {
+  for (PageNodeImpl* page_impl : opened_page_nodes()) {
     const PageNode* page = page_impl;
     if (!visitor(page)) {
       return false;
@@ -552,7 +555,7 @@ const base::flat_set<const PageNode*> FrameNodeImpl::GetOpenedPageNodes()
 bool FrameNodeImpl::VisitEmbeddedPageNodes(
     const PageNodeVisitor& visitor) const {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  for (auto* page_impl : embedded_page_nodes()) {
+  for (PageNodeImpl* page_impl : embedded_page_nodes()) {
     const PageNode* page = page_impl;
     if (!visitor(page)) {
       return false;
@@ -576,7 +579,7 @@ const base::flat_set<const WorkerNode*> FrameNodeImpl::GetChildWorkerNodes()
 bool FrameNodeImpl::VisitChildDedicatedWorkers(
     const WorkerNodeVisitor& visitor) const {
   DCHECK_CALLED_ON_VALID_SEQUENCE(sequence_checker_);
-  for (auto* worker_node_impl : child_worker_nodes()) {
+  for (WorkerNodeImpl* worker_node_impl : child_worker_nodes()) {
     const WorkerNode* node = worker_node_impl;
     if (node->GetWorkerType() == WorkerNode::WorkerType::kDedicated &&
         !visitor(node)) {
@@ -680,7 +683,7 @@ void FrameNodeImpl::SeverPageRelationshipsAndMaybeReparent() {
   // disappear, or it must be explicitly severed (this can happen with
   // portals).
   while (!opened_page_nodes_.empty()) {
-    auto* opened_node = *opened_page_nodes_.begin();
+    auto* opened_node = (*opened_page_nodes_.begin()).get();
     if (parent_frame_node_) {
       opened_node->SetOpenerFrameNode(parent_frame_node_);
     } else {
@@ -690,7 +693,7 @@ void FrameNodeImpl::SeverPageRelationshipsAndMaybeReparent() {
   }
 
   while (!embedded_page_nodes_.empty()) {
-    auto* embedded_node = *embedded_page_nodes_.begin();
+    auto* embedded_node = (*embedded_page_nodes_.begin()).get();
     auto embedding_type = embedded_node->GetEmbeddingType();
     if (parent_frame_node_) {
       embedded_node->SetEmbedderFrameNodeAndEmbeddingType(parent_frame_node_,