This page contains a control-role accessibility node
(ax::mojom::Role::kTextField, for which
ui::IsControl() returns true). With the accompanying
renderer-side patch applied (chromium-changes.patch), the
renderer serialises an out-of-range kInvalidState int
attribute (0x41414141) for this node and ships it to the
browser process via the unmodified accessibility-tree Mojo pipe.
On macOS with an accessibility client attached (VoiceOver, or Chrome
launched with --force-renderer-accessibility and a tool such
as Accessibility Inspector), querying the AXInvalid attribute
on the field below dispatches to
-[AXPlatformNodeCocoa AXInvalid]. The exhaustive
switch there has no default:, no trailing
return, and no NOTREACHED(), so control falls
off the end of a non-void Objective-C++ method — undefined
behaviour in the unsandboxed browser process. The garbage value left in
the return register is typed as NSString*/id
and is immediately retained by ARC and messaged by AppKit
(objc_msgSend).
The aria-invalid="true" attribute is irrelevant to the
out-of-range value (the renderer patch overwrites it); it is present so
that an unpatched build still advertises a non-default invalid state for
comparison.