commit 603a95298a15f4b16e2de7dad5a126652ba2ab76
parent dee50dbe260f158f388f51c0182eafb3b1df78f0
Author: Fernando Fiori <ffiori@microsoft.com>
Date: Tue, 16 Dec 2025 08:46:57 +0000
Bug 2005676 [wpt PR 56707] - [css-highlight-api] Fix crash when overlapping with aria-invalid, a=testonly
Automatic update from web-platform-tests
[css-highlight-api] Fix crash when overlapping with aria-invalid
Add kNone to the list of highlight types when adding aria-invalid
markers in SerializeMarkerAttributes(). For each marker that is added,
there should be exactly one HighlightType, one integer corresponding to
the marker start position and one integer corresponding to the marker
end position. The vectors containing these values should be all the same
size because when the marker information needs to be retrieved, if
there's a custom highlight marker, then the highlight type needs to be
accessed at the same index as the marker to be able to keep track of
every document marker's data.
This CL also adds (D)CHECKS for these conditions, a unit test for
AXInlineTextBox and a crashing WPT test which would crash before this
change and now passes.
Bug: 428039224
Change-Id: Icf2f9f4c882eb7cbfb845de36c249a106e5af861
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7233304
Commit-Queue: Fernando Fiori <ffiori@microsoft.com>
Reviewed-by: Benjamin Beaudry <benjamin.beaudry@microsoft.com>
Reviewed-by: Kent Tamura <tkent@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1557780}
--
wpt-commits: b8c9243eee63dc9b7730236ccd9c9c8e02dcacaa
wpt-pr: 56707
Diffstat:
1 file changed, 15 insertions(+), 0 deletions(-)
diff --git a/testing/web-platform/tests/css/css-highlight-api/crashtests/highlight-overlap-with-aria-invalid-crash.html b/testing/web-platform/tests/css/css-highlight-api/crashtests/highlight-overlap-with-aria-invalid-crash.html
@@ -0,0 +1,14 @@
+<!DOCTYPE html>
+<style>
+ ::highlight(test) { background-color: yellow; }
+</style>
+<div aria-invalid="grammar" id="div1">This are a dog</div>
+<script>
+ const div1 = document.getElementById("div1");
+ const text_node = div1.firstChild;
+ const range = document.createRange();
+ range.setStart(div1, 0);
+ range.setEnd(div1, 1);
+ const highlight = new Highlight(range);
+ CSS.highlights.set("test", highlight);
+</script>
+\ No newline at end of file
