From 5ebfd7687bf83aba0ee5e96dc522f306b18a7607 Mon Sep 17 00:00:00 2001
From: Jihad Hanna <jihadghanna@google.com>
Date: Wed, 20 May 2026 01:16:03 -0700
Subject: [PATCH] Validate field bounds are visible when querying Autofill suggestions

Fixed: 514067524
Change-Id: I68a84d5fb79a68cb1229e7c556a73420e1490838
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/7859672
Reviewed-by: Friedrich Hauser <friedrichh@chromium.org>
Commit-Queue: Jihad Hanna <jihadghanna@google.com>
Cr-Commit-Position: refs/heads/main@{#1633410}
---

diff --git a/components/android_autofill/browser/java/src/org/chromium/components/autofill/AutofillProvider.java b/components/android_autofill/browser/java/src/org/chromium/components/autofill/AutofillProvider.java
index 1f630d665..0f7fd95 100644
--- a/components/android_autofill/browser/java/src/org/chromium/components/autofill/AutofillProvider.java
+++ b/components/android_autofill/browser/java/src/org/chromium/components/autofill/AutofillProvider.java
@@ -270,11 +270,13 @@
     public void queryAutofillSuggestion() {
         if (shouldQueryAutofillSuggestion()) {
             FocusField focusField = mRequest.getFocusField();
+            @Nullable Rect clampedBounds = clampToVisibleBounds(focusField.absBound);
+            if (clampedBounds == null) return;
             getAutofillManagerWrapper()
                     .requestAutofill(
                             mContainerView,
                             mRequest.getFieldVirtualId(focusField.fieldIndex),
-                            focusField.absBound);
+                            clampedBounds);
         }
     }
 
@@ -494,9 +496,13 @@
     private void notifyVirtualViewEntered(View parent, int index, Rect absBounds) {
         // Refer to notifyVirtualValueChanged() for the reason of the datalist's special handling.
         if (isDatalistField(index)) return;
+
+        @Nullable Rect clampedBounds = clampToVisibleBounds(absBounds);
+        if (clampedBounds == null) return;
+
         getAutofillManagerWrapper()
                 .notifyVirtualViewEntered(
-                        parent, mRequest.getFieldVirtualId((short) index), absBounds);
+                        parent, mRequest.getFieldVirtualId((short) index), clampedBounds);
     }
 
     private void notifyVirtualViewExited(View parent, int index) {
@@ -797,6 +803,50 @@
         return mDatalistPopup;
     }
 
+    /**
+     * Calculates the visible bounds of the container view in screen coordinates.
+     *
+     * @return a {@link Rect} representing the visible area of the container in screen coordinates,
+     *     or an empty {@link Rect} if the container is not visible.
+     */
+    private Rect getContainerVisibleScreenBounds() {
+        Rect rect = new Rect();
+        if (mContainerView.getGlobalVisibleRect(rect)) {
+            int[] windowLocation = new int[2];
+            mContainerView.getLocationInWindow(windowLocation);
+            int[] screenLocation = new int[2];
+            mContainerView.getLocationOnScreen(screenLocation);
+            int offsetX = screenLocation[0] - windowLocation[0];
+            int offsetY = screenLocation[1] - windowLocation[1];
+            rect.offset(offsetX, offsetY);
+        }
+        return rect;
+    }
+
+    /**
+     * Clamps the given absolute bounds to the visible screen bounds of the container view.
+     *
+     * <p>Calculates the intersection of {@code absBounds} with the visible area of {@code
+     * mContainerView}. If the bounds are entirely outside the visible area, returns {@code null}.
+     *
+     * <p>This method returns new coordinates and does not mutate the input.
+     *
+     * @param absBounds the absolute bounds in screen coordinates to clamp.
+     * @return coordinates representing the clamped bounds, or {@code null} if the bounds do not
+     *     intersect with the container's visible area.
+     */
+    private @Nullable Rect clampToVisibleBounds(Rect absBounds) {
+        Rect visibleBounds = getContainerVisibleScreenBounds();
+        if (absBounds.isEmpty()) {
+            return visibleBounds.contains(absBounds.left, absBounds.top)
+                    ? new Rect(absBounds)
+                    : null;
+        }
+
+        Rect clampedBounds = new Rect(absBounds);
+        return clampedBounds.intersect(visibleBounds) ? clampedBounds : null;
+    }
+
     private Rect transformToWindowBounds(RectF rect) {
         // Refer to crbug.com/1085294 for the reason of offset.
         // The current version of Mockito didn't support mock static method, adding extra method so
diff --git a/components/android_autofill/browser/junit/src/org/chromium/components/autofill/AutofillProviderTest.java b/components/android_autofill/browser/junit/src/org/chromium/components/autofill/AutofillProviderTest.java
index c09543c..eb52e671 100644
--- a/components/android_autofill/browser/junit/src/org/chromium/components/autofill/AutofillProviderTest.java
+++ b/components/android_autofill/browser/junit/src/org/chromium/components/autofill/AutofillProviderTest.java
@@ -8,6 +8,7 @@
 import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNotSame;
+import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyBoolean;
@@ -38,10 +39,8 @@
 import org.junit.runner.RunWith;
 import org.mockito.Mock;
 import org.mockito.Mockito;
-import org.mockito.invocation.InvocationOnMock;
 import org.mockito.junit.MockitoJUnit;
 import org.mockito.junit.MockitoRule;
-import org.mockito.stubbing.Answer;
 import org.robolectric.annotation.Config;
 
 import org.chromium.base.test.BaseRobolectricTestRunner;
@@ -79,6 +78,7 @@
 
     // Virtual Id of the field with focus.
     private int mFocusVirtualId;
+    private Rect mFocusBounds;
 
     // Virtual Id of the field to show the bottom sheet for.
     private int mDialogVirtualId;
@@ -113,6 +113,7 @@
         @Override
         public void notifyVirtualViewEntered(View parent, int childId, Rect absBounds) {
             mFocusVirtualId = childId;
+            mFocusBounds = absBounds;
             super.notifyVirtualViewEntered(parent, childId, absBounds);
         }
 
@@ -154,19 +155,34 @@
         when(mContainerView.getScrollX()).thenReturn(SCROLL_X);
         when(mContainerView.getScrollY()).thenReturn(SCROLL_Y);
         doAnswer(
-                        new Answer<>() {
-                            @Override
-                            public Void answer(InvocationOnMock invocation) {
-                                Object[] args = invocation.getArguments();
-                                int[] location = (int[]) args[0];
-                                location[0] = LOCATION_X;
-                                location[1] = LOCATION_Y;
-                                return null;
-                            }
+                        invocation -> {
+                            int[] location = invocation.getArgument(0);
+                            location[0] = LOCATION_X;
+                            location[1] = LOCATION_Y;
+                            return null;
                         })
                 .when(mContainerView)
                 .getLocationOnScreen(any());
 
+        doAnswer(
+                        invocation -> {
+                            Rect rect = invocation.getArgument(0);
+                            rect.set(0, 0, 2000, 2000);
+                            return true;
+                        })
+                .when(mContainerView)
+                .getGlobalVisibleRect(any(Rect.class));
+
+        doAnswer(
+                        invocation -> {
+                            int[] location = invocation.getArgument(0);
+                            location[0] = LOCATION_X;
+                            location[1] = LOCATION_Y;
+                            return null;
+                        })
+                .when(mContainerView)
+                .getLocationInWindow(any());
+
         RenderCoordinatesImpl.setInstanceForTesting(mRenderCoordinates);
         when(mRenderCoordinates.getContentOffsetYPixInt()).thenReturn(0);
 
@@ -439,6 +455,85 @@
         verify(mNativeMock).hasPasskeyRequest(eq(mMockedNativeAndroidAutofillProvider));
     }
 
+    @Test
+    public void testSuppressNotificationOutsideBounds() {
+        // Mock container view to be at [0, 0, 100, 100] on screen
+        doAnswer(
+                        invocation -> {
+                            Rect rect = invocation.getArgument(0);
+                            rect.set(0, 0, 100, 100);
+                            return true;
+                        })
+                .when(mContainerView)
+                .getGlobalVisibleRect(any(Rect.class));
+
+        doAnswer(
+                        invocation -> {
+                            int[] location = invocation.getArgument(0);