From 1660791100160664a5358b9b79660f7791001b34 Mon Sep 17 00:00:00 2001
From: Thomas Nguyen <[email protected]>
Date: Fri, 11 Sep 2026 14:04:19 -0700
Subject: [PATCH] [CE]: Reset inherited writing-mode on capability elements

GetCascadeFilter() rejects declarations of properties that are not on
the kValidForPermissionElement allow-list, but inherited values are
copied from the parent style before the cascade runs and so bypass the
filter. AdjustStyle() already resets a few such properties; add
writing-mode, text-orientation and text-combine-upright to that list and
call UpdateFontOrientation() to keep the font in sync. We should not
allow those values to be inherited.

Fixed: 514071472
Change-Id: I565e4d399400bc0eb6a572d256f49a76f66a11bb
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8303435
Commit-Queue: Joey Arhar <[email protected]>
Auto-Submit: Thomas Nguyen <[email protected]>
Reviewed-by: Joey Arhar <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1696586}
---
diff --git a/third_party/blink/renderer/core/html/html_capability_element_base.cc b/third_party/blink/renderer/core/html/html_capability_element_base.cc
index 34c053bc..53c0832 100644
--- a/third_party/blink/renderer/core/html/html_capability_element_base.cc
+++ b/third_party/blink/renderer/core/html/html_capability_element_base.cc
@@ -921,14 +921,19 @@
     }
   }
 
-  // These webkit-prefixed properties are not supported by the permission
-  // element. But since they are inherited by default, they are passed through
-  // to the internal permission text span, even if they're not on the list of
-  // allowed CSS properties.
+  // These properties are not supported by the permission element. But since
+  // they are inherited by default, they are passed through to the internal
+  // permission text span, even if they're not on the list of allowed CSS
+  // properties.
   // Reset them here to avoid any side effects.
   builder.ResetTextStrokeWidth();
   builder.ResetTextFillColor();
   builder.ResetTextStrokeColor();
+  // TODO(crbug.com/560222073): Handle vertical writing mode properly.
+  builder.ResetWritingMode();
+  builder.ResetTextOrientation();
+  builder.ResetTextCombine();
+  builder.UpdateFontOrientation();
 
   // To prevent CSS :visited history leaks and ensure the button remains
   // fully legible and active in all states, we force the element to pretend
diff --git a/third_party/blink/renderer/core/html/html_capability_element_base_test.cc b/third_party/blink/renderer/core/html/html_capability_element_base_test.cc
index c5c6a849..2d282ec 100644
--- a/third_party/blink/renderer/core/html/html_capability_element_base_test.cc
+++ b/third_party/blink/renderer/core/html/html_capability_element_base_test.cc
@@ -1078,6 +1078,35 @@
             style->VisitedDependentColor(GetCSSPropertyBackgroundColor()));
 }
 
+TEST_F(HTMLCapabilityElementBaseSimTest, InheritedVerticalWritingModeIsReset) {
+  // Properties that are not on the allow-list can still be inherited from a
+  // parent element. Verify that an inherited vertical writing-mode is reset so
+  // that the size constraints, which assume a horizontal inline axis, keep the
+  // text inside the element's bounds.
+  GetDocument().body()->setAttribute(
+      html_names::kStyleAttr,
+      AtomicString("writing-mode: vertical-rl; text-orientation: upright;"));
+  auto* permission_element = CreatePermissionElement(GetDocument(), "camera");
+  GetDocument().UpdateStyleAndLayout(DocumentUpdateReason::kTest);
+
+  const ComputedStyle* style = permission_element->GetComputedStyle();
+  ASSERT_TRUE(style);
+  EXPECT_EQ(WritingMode::kHorizontalTb, style->GetWritingMode());
+  EXPECT_EQ(ETextOrientation::kMixed, style->GetTextOrientation());
+  EXPECT_EQ(FontOrientation::kHorizontal,
+            style->GetFontDescription().Orientation());
+
+  auto* text_span =
+      permission_element->permission_text_span_for_testing().Get();
+  ASSERT_TRUE(text_span);
+  gfx::Rect element_rect =
+      permission_element->GetBoundingClientRect()->ToEnclosingRect();
+  gfx::Rect text_rect = text_span->GetBoundingClientRect()->ToEnclosingRect();
+  EXPECT_TRUE(element_rect.Contains(text_rect))
+      << "element=" << element_rect.ToString()
+      << " text=" << text_rect.ToString();
+}
+
 TEST_F(HTMLCapabilityElementBaseSimTest, FontSizeCanDisableElement) {
   GetDocument().GetSettings()->SetDefaultFontSize(12);
   auto* permission_element = CreatePermissionElement(GetDocument(), "camera");

diff --git a/third_party/blink/renderer/core/html/html_capability_element_base_test.cc b/third_party/blink/renderer/core/html/html_capability_element_base_test.cc
index c5c6a849..2d282ec 100644
--- a/third_party/blink/renderer/core/html/html_capability_element_base_test.cc
+++ b/third_party/blink/renderer/core/html/html_capability_element_base_test.cc
@@ -1078,6 +1078,35 @@
             style->VisitedDependentColor(GetCSSPropertyBackgroundColor()));
 }
 
+TEST_F(HTMLCapabilityElementBaseSimTest, InheritedVerticalWritingModeIsReset) {
+  // Properties that are not on the allow-list can still be inherited from a
+  // parent element. Verify that an inherited vertical writing-mode is reset so
+  // that the size constraints, which assume a horizontal inline axis, keep the
+  // text inside the element's bounds.
+  GetDocument().body()->setAttribute(
+      html_names::kStyleAttr,
+      AtomicString("writing-mode: vertical-rl; text-orientation: upright;"));
+  auto* permission_element = CreatePermissionElement(GetDocument(), "camera");
+  GetDocument().UpdateStyleAndLayout(DocumentUpdateReason::kTest);
+
+  const ComputedStyle* style = permission_element->GetComputedStyle();
+  ASSERT_TRUE(style);
+  EXPECT_EQ(WritingMode::kHorizontalTb, style->GetWritingMode());
+  EXPECT_EQ(ETextOrientation::kMixed, style->GetTextOrientation());
+  EXPECT_EQ(FontOrientation::kHorizontal,
+            style->GetFontDescription().Orientation());
+
+  auto* text_span =
+      permission_element->permission_text_span_for_testing().Get();
+  ASSERT_TRUE(text_span);
+  gfx::Rect element_rect =
+      permission_element->GetBoundingClientRect()->ToEnclosingRect();
+  gfx::Rect text_rect = text_span->GetBoundingClientRect()->ToEnclosingRect();
+  EXPECT_TRUE(element_rect.Contains(text_rect))
+      << "element=" << element_rect.ToString()
+      << " text=" << text_rect.ToString();
+}
+
 TEST_F(HTMLCapabilityElementBaseSimTest, FontSizeCanDisableElement) {
   GetDocument().GetSettings()->SetDefaultFontSize(12);
   auto* permission_element = CreatePermissionElement(GetDocument(), "camera");