From 42d8e82efd1a5c6a13af3bb40bf954c1c0f7518e Mon Sep 17 00:00:00 2001
From: Andrew Paseltiner <apaseltiner@chromium.org>
Date: Thu, 10 Sep 2026 10:43:33 -0700
Subject: [PATCH] Fix window bounds intersection check for small window sizes

WindowBoundsIntersectDisplays() requires requested window bounds to
intersect displays by at least 50% of their area. Previously, the
threshold was calculated using integer division by two, which truncated
to zero for areas of 0 or 1. As a result, non-intersecting bounds with
empty or tiny areas were treated as valid and accepted.

This change:
- Explicitly rejects empty bounds.
- Caches the validated window area to avoid recomputing it.
- Uses multiplication (2 * intersect_area >= bounds_area) rather than
  division to ensure the 50% threshold calculation is exact for all
  sizes.
- Widens the intersection accumulator to int64_t to prevent arithmetic
  overflow across displays.
- Keeps window creation specifying only a position supported on
  platforms where default bounds have not yet been initialized.

TAG=agy
CONV=aa700909-149a-4cce-93e8-4743710a6226

Fixed: 477327257
Change-Id: I153ce57f28505f5aa45bd4cef710f15d5138228c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8379586
Commit-Queue: Andrew Paseltiner <apaseltiner@chromium.org>
Reviewed-by: Tim <tjudkins@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1695499}
---
diff --git a/chrome/browser/extensions/api/tabs/tabs_api.cc b/chrome/browser/extensions/api/tabs/tabs_api.cc
index 2bd7e200..6d67307 100644
--- a/chrome/browser/extensions/api/tabs/tabs_api.cc
+++ b/chrome/browser/extensions/api/tabs/tabs_api.cc
@@ -839,13 +839,22 @@
     return false;
   }
 
-  int intersect_area = 0;
+  // An empty rect cannot intersect any display.
+  if (bounds.IsEmpty()) {
+    return false;
+  }
+
+  const int bounds_area = checked_area.ValueOrDie();
+
+  int64_t intersect_area = 0;
   for (const auto& display : display::Screen::Get()->GetAllDisplays()) {
     gfx::Rect display_bounds = display.bounds();
     display_bounds.Intersect(bounds);
     intersect_area += display_bounds.size().GetArea();
   }
-  return intersect_area >= (bounds.size().GetArea() / 2);
+  // Compare using multiplication rather than division, which would truncate
+  // to zero for areas smaller than two.
+  return 2 * intersect_area >= bounds_area;
 }
 
 }  // namespace tabs_internal
@@ -1511,8 +1520,12 @@
     window_bounds.AdjustToFit(display.bounds());
   }
 
-  // Immediately fail if the window bounds don't intersect the displays.
-  if ((set_window_position || set_window_size) &&
+  // Immediately fail if the window bounds don't intersect the displays. If
+  // only a position was specified and the default bounds have not been
+  // initialized (see above), there is no size to validate against yet.
+  const bool has_bounds_to_validate =
+      set_window_size || (set_window_position && !window_bounds.IsEmpty());
+  if (has_bounds_to_validate &&
       !tabs_internal::WindowBoundsIntersectDisplays(window_bounds)) {
     return tabs_constants::kInvalidWindowBoundsError;
   }
diff --git a/chrome/browser/extensions/api/tabs/tabs_test.cc b/chrome/browser/extensions/api/tabs/tabs_test.cc
index 282aa75..723621d8 100644
--- a/chrome/browser/extensions/api/tabs/tabs_test.cc
+++ b/chrome/browser/extensions/api/tabs/tabs_test.cc
@@ -1061,6 +1061,52 @@
   }
 }
 
+IN_PROC_BROWSER_TEST_F(ExtensionTabsTest,
+                       InvalidUpdateWindowBoundsWithSmallSizes) {
+  scoped_refptr<const Extension> extension(ExtensionBuilder("Test").Build());
+
+  // Get the display bounds so we can position the window outside of them.
+  gfx::Rect displays;
+  for (const auto& display : display::Screen::Get()->GetAllDisplays()) {
+    displays.Union(display.bounds());
+  }
+
+  int window_id = ExtensionTabUtil::GetWindowId(browser_window_interface());
+  int window_left = displays.right() + 10;
+  int window_top = displays.bottom() + 10;
+
+  static const char kArgsUpdateFunction[] =
+      "[%u, {\"left\": %d, \"top\": %d, \"width\": %d, \"height\": %d}]";
+
+  // Windows with an empty or tiny size cannot be moved outside the displays.
+  constexpr struct {
+    int width;
+    int height;
+  } kSizes[] = {{0, 500}, {500, 0}, {0, 0}, {1, 1}};
+  for (const auto& size : kSizes) {
+    auto function = base::MakeRefCounted<WindowsUpdateFunction>();
+    function->set_extension(extension.get());
+    EXPECT_TRUE(base::MatchPattern(
+        utils::RunFunctionAndReturnError(
+            function.get(),
+            base::StringPrintf(kArgsUpdateFunction, window_id, window_left,
+                               window_top, size.width, size.height),
+            profile()),
+        keys::kInvalidWindowBoundsError))
+        << "size: " << size.width << "x" << size.height;
+  }
+
+  // Resizing a window to an empty size is not valid regardless of its
+  // position.
+  auto function = base::MakeRefCounted<WindowsUpdateFunction>();
+  function->set_extension(extension.get());
+  EXPECT_TRUE(base::MatchPattern(
+      utils::RunFunctionAndReturnError(
+          function.get(), base::StringPrintf("[%u, {\"width\": 0}]", window_id),
+          profile()),
+      keys::kInvalidWindowBoundsError));
+}
+
 // On Android this fails when Run() calls BaseWindow::CanResize() returns false
 // due to default Android Browser Tests not having free-form windows.
 #if !BUILDFLAG(IS_ANDROID)
@@ -1095,6 +1141,26 @@
                            profile(), api_test_utils::FunctionMode::kNone));
   }
 }
+
+IN_PROC_BROWSER_TEST_F(ExtensionTabsTest,
+                       UpdatingWindowBoundsSucceedsForSmallOnScreenBounds) {
+  scoped_refptr<const Extension> extension(ExtensionBuilder("Test").Build());
+
+  int window_id = ExtensionTabUtil::GetWindowId(browser_window_interface());
+
+  // A tiny window is valid as long as it is fully within a display.
+  const gfx::Point center =
+      display::Screen::Get()->GetPrimaryDisplay().bounds().CenterPoint();
+  static const char kArgsUpdateFunction[] =
+      "[%u, {\"left\": %d, \"top\": %d, \"width\": 1, \"height\": 1}]";
+  auto function = base::MakeRefCounted<WindowsUpdateFunction>();
+  function->set_extension(extension.get());
+  EXPECT_TRUE(
+      utils::RunFunction(function.get(),
+                         base::StringPrintf(kArgsUpdateFunction, window_id,
+                                            center.x(), center.y()),
+                         profile(), api_test_utils::FunctionMode::kNone));
+}
 #endif  // !BUILDFLAG(IS_ANDROID)
 
 #if BUILDFLAG(IS_ANDROID)
@@ -1395,6 +1461,52 @@
   }
 }
 
+IN_PROC_BROWSER_TEST_F(ExtensionWindowCreateTest,
+                       ValidateCreateWindowBoundsWithSmallSizes) {
+  // Get the display bounds so we can position the window outside of them.
+  gfx::Rect displays;
+  for (const auto& display : display::Screen::Get()->GetAllDisplays()) {
+    displays.Union(display.bounds());
+  }
+
+  static const char kArgsCreateFunction[] =
+      "[{\"left\": %d, \"top\": %d, \"width\": %d, \"height\": %d }]";
+  int window_left = displays.right() + 10;
+  int window_top = displays.bottom() + 10;
+
+  // Windows with an empty or tiny size cannot be created outside the
+  // displays.
+  constexpr struct {
+    int width;
+    int height;
+  } kSizes[] = {{0, 100}, {100, 0}, {0, 0}, {1, 1}};
+  for (const auto& size : kSizes) {
+    EXPECT_TRUE(base::MatchPattern(
+        RunCreateWindowExpectError(base::StringPrintf(kArgsCreateFunction,
+                                                      window_left, window_top,
+                                                      size.width, size.height)),
+        keys::kInvalidWindowBoundsError))
+        << "size: " << size.width << "x" << size.height;
+  }
+
+  // Bounds with an empty size are not valid regardless of position.
+  EXPECT_TRUE(base::MatchPattern(
+      RunCreateWindowExpectError("[{\"width\": 0, \"height\": 0 }]"),
+      keys::kInvalidWindowBoundsError));
+
+  {
+    // A tiny window is valid as long as it is fully within a display.
+    const gfx::Point center =
+        display::Screen::Get()->GetPrimaryDisplay().bounds().CenterPoint();
+    auto function = base::MakeRefCounted<WindowsCreateFunction>();
+    function->set_extension(ExtensionBuilder("Test").Build().get());
+    EXPECT_TRUE(utils::RunFunction(
+        function.get(),
+        base::StringPrintf(kArgsCreateFunction, center.x(), center.y(), 1, 1),
+        profile(), api_test_utils::FunctionMode::kNone));
+  }
+}
+
 IN_PROC_BROWSER_TEST_F(ExtensionWindowCreateTest, CreatePopupWindowFromWebUI) {
   auto function = base::MakeRefCounted<WindowsCreateFunction>();
   function->SetBrowserContextForTesting(profile());

diff --git a/chrome/browser/extensions/api/tabs/tabs_test.cc b/chrome/browser/extensions/api/tabs/tabs_test.cc
index 282aa75..723621d8 100644
--- a/chrome/browser/extensions/api/tabs/tabs_test.cc
+++ b/chrome/browser/extensions/api/tabs/tabs_test.cc
@@ -1061,6 +1061,52 @@
   }
 }
 
+IN_PROC_BROWSER_TEST_F(ExtensionTabsTest,
+                       InvalidUpdateWindowBoundsWithSmallSizes) {
+  scoped_refptr<const Extension> extension(ExtensionBuilder("Test").Build());
+
+  // Get the display bounds so we can position the window outside of them.
+  gfx::Rect displays;
+  for (const auto& display : display::Screen::Get()->GetAllDisplays()) {
+    displays.Union(display.bounds());
+  }
+
+  int window_id = ExtensionTabUtil::GetWindowId(browser_window_interface());
+  int window_left = displays.right() + 10;
+  int window_top = displays.bottom() + 10;
+
+  static const char kArgsUpdateFunction[] =
+      "[%u, {\"left\": %d, \"top\": %d, \"width\": %d, \"height\": %d}]";
+
+  // Windows with an empty or tiny size cannot be moved outside the displays.
+  constexpr struct {
+    int width;
+    int height;
+  } kSizes[] = {{0, 500}, {500, 0}, {0, 0}, {1, 1}};
+  for (const auto& size : kSizes) {
+    auto function = base::MakeRefCounted<WindowsUpdateFunction>();
+    function->set_extension(extension.get());
+    EXPECT_TRUE(base::MatchPattern(
+        utils::RunFunctionAndReturnError(
+            function.get(),
+            base::StringPrintf(kArgsUpdateFunction, window_id, window_left,
+                               window_top, size.width, size.height),
+            profile()),
+        keys::kInvalidWindowBoundsError))
+        << "size: " << size.width << "x" << size.height;
+  }
+
+  // Resizing a window to an empty size is not valid regardless of its
+  // position.
+  auto function = base::MakeRefCounted<WindowsUpdateFunction>();
+  function->set_extension(extension.get());
+  EXPECT_TRUE(base::MatchPattern(
+      utils::RunFunctionAndReturnError(
+          function.get(), base::StringPrintf("[%u, {\"width\": 0}]", window_id),
+          profile()),
+      keys::kInvalidWindowBoundsError));
+}
+
 // On Android this fails when Run() calls BaseWindow::CanResize() returns false
 // due to default Android Browser Tests not having free-form windows.
 #if !BUILDFLAG(IS_ANDROID)
@@ -1095,6 +1141,26 @@
                            profile(), api_test_utils::FunctionMode::kNone));
   }
 }
+
+IN_PROC_BROWSER_TEST_F(ExtensionTabsTest,
+                       UpdatingWindowBoundsSucceedsForSmallOnScreenBounds) {
+  scoped_refptr<const Extension> extension(ExtensionBuilder("Test").Build());
+
+  int window_id = ExtensionTabUtil::GetWindowId(browser_window_interface());
+
+  // A tiny window is valid as long as it is fully within a display.
+  const gfx::Point center =
+      display::Screen::Get()->GetPrimaryDisplay().bounds().CenterPoint();
+  static const char kArgsUpdateFunction[] =
+      "[%u, {\"left\": %d, \"top\": %d, \"width\": 1, \"height\": 1}]";
+  auto function = base::MakeRefCounted<WindowsUpdateFunction>();
+  function->set_extension(extension.get());
+  EXPECT_TRUE(
+      utils::RunFunction(function.get(),
+                         base::StringPrintf(kArgsUpdateFunction, window_id,
+                                            center.x(), center.y()),
+                         profile(), api_test_utils::FunctionMode::kNone));
+}
 #endif  // !BUILDFLAG(IS_ANDROID)
 
 #if BUILDFLAG(IS_ANDROID)
@@ -1395,6 +1461,52 @@
   }
 }
 
+IN_PROC_BROWSER_TEST_F(ExtensionWindowCreateTest,
+                       ValidateCreateWindowBoundsWithSmallSizes) {
+  // Get the display bounds so we can position the window outside of them.
+  gfx::Rect displays;
+  for (const auto& display : display::Screen::Get()->GetAllDisplays()) {
+    displays.Union(display.bounds());
+  }
+
+  static const char kArgsCreateFunction[] =
+      "[{\"left\": %d, \"top\": %d, \"width\": %d, \"height\": %d }]";
+  int window_left = displays.right() + 10;
+  int window_top = displays.bottom() + 10;
+
+  // Windows with an empty or tiny size cannot be created outside the
+  // displays.
+  constexpr struct {
+    int width;
+    int height;
+  } kSizes[] = {{0, 100}, {100, 0}, {0, 0}, {1, 1}};
+  for (const auto& size : kSizes) {
+    EXPECT_TRUE(base::MatchPattern(
+        RunCreateWindowExpectError(base::StringPrintf(kArgsCreateFunction,
+                                                      window_left, window_top,
+                                                      size.width, size.height)),
+        keys::kInvalidWindowBoundsError))
+        << "size: " << size.width << "x" << size.height;
+  }
+
+  // Bounds with an empty size are not valid regardless of position.
+  EXPECT_TRUE(base::MatchPattern(
+      RunCreateWindowExpectError("[{\"width\": 0, \"height\": 0 }]"),
+      keys::kInvalidWindowBoundsError));
+
+  {
+    // A tiny window is valid as long as it is fully within a display.
+    const gfx::Point center =
+        display::Screen::Get()->GetPrimaryDisplay().bounds().CenterPoint();
+    auto function = base::MakeRefCounted<WindowsCreateFunction>();
+    function->set_extension(ExtensionBuilder("Test").Build().get());
+    EXPECT_TRUE(utils::RunFunction(
+        function.get(),
+        base::StringPrintf(kArgsCreateFunction, center.x(), center.y(), 1, 1),
+        profile(), api_test_utils::FunctionMode::kNone));
+  }
+}
+
 IN_PROC_BROWSER_TEST_F(ExtensionWindowCreateTest, CreatePopupWindowFromWebUI) {
   auto function = base::MakeRefCounted<WindowsCreateFunction>();
   function->SetBrowserContextForTesting(profile());