From 9b2d1724885538396738e52ca2e5c9eadd067c2d Mon Sep 17 00:00:00 2001
From: Friedrich Horschig <[email protected]>
Date: Mon, 28 Sep 2026 03:44:22 -0700
Subject: [PATCH] [Android][Autofill] Suppress datalist popup when field is outside visible bounds

AutofillProvider displays a native datalist popup for <input list>
fields via showDatalistPopup(). Previously, the renderer-supplied field
bounds were used directly to position the native popup anchor without
verifying that the field is currently within the container view's
visible bounds.

If a page places a datalist input entirely outside the visible viewport
(e.g. styled off-screen) and focuses it with preventScroll, the
unclamped anchor causes Android's popup layer to pin the dropdown to the
top of the window frame, potentially overlaying the browser toolbar or
embedder UI.

This CL checks whether the transformed field bounds intersect the
visible container screen bounds via clampToVisibleBounds(). If the field
is outside the visible area:
- Any existing datalist popup is dismissed.
- The new popup is suppressed before acquiring an anchor view.

Note that we deliberately clamp the field's anchor bounds rather than
FocusField.absBound because the anchor rect itself is the source of
truth passed to setAnchorViewRect().

Screenshot: http://screen/1g78qg20v5q9g
Kill-switch: AndroidAutofillSuppressOffscreenDatalist
Fixed: 562236428
Change-Id: I5d4448cf93a2cb34233d69e2d7930422d84c8239
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8459967
Commit-Queue: Friedrich Hauser <[email protected]>
Reviewed-by: Timofey Chudakov <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1705969}
---
diff --git a/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java b/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
index a96bebe4..20cc290 100644
--- a/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
+++ b/android_webview/java/src/org/chromium/android_webview/common/ProductionSupportedFlagList.java
@@ -64,9 +64,7 @@
      * updating the "LoginCustomFlags" field in tools/metrics/histograms/enums.xml.
      */
     public static final Flag[] sFlagList = {
-        Flag.baseFeature(
-                "useicu4xnormalizer",
-                "Auto-generated flag for useicu4xnormalizer."),
+        Flag.baseFeature("useicu4xnormalizer", "Auto-generated flag for useicu4xnormalizer."),
         Flag.baseFeature("AwMetricsLogTrimming", "Auto-generated flag for AwMetricsLogTrimming."),
         Flag.commandLine(
                 AwSwitches.HIGHLIGHT_ALL_WEBVIEWS,
@@ -255,6 +253,10 @@
                 AndroidAutofillFeatures.ANDROID_AUTOFILL_FIELDS_UPDATED_ON_SELECT_NAME,
                 "Enable updating autofill field origin on select control change."),
         Flag.baseFeature(
+                AndroidAutofillFeatures.ANDROID_AUTOFILL_SUPPRESS_OFFSCREEN_DATALIST_NAME,
+                "When enabled, datalist popups are suppressed when the field is outside the"
+                        + " container view's visible bounds."),
+        Flag.baseFeature(
                 AutofillFeatures.AUTOFILL_ACCEPT_DOM_MUTATION_AFTER_AUTOFILL_SUBMISSION,
                 "Accepts DOM_MUTATION_AFTER_AUTOFILL submissions detected on password forms."),
         Flag.baseFeature(
diff --git a/components/android_autofill/browser/android_autofill_features.cc b/components/android_autofill/browser/android_autofill_features.cc
index 763e647b..18d1a4e8 100644
--- a/components/android_autofill/browser/android_autofill_features.cc
+++ b/components/android_autofill/browser/android_autofill_features.cc
@@ -22,6 +22,7 @@
     &kAndroidAutofillLazyFrameworkWrapper,
     &kAndroidAutofillImprovedVisibilityDetection,
     &kAndroidAutofillFieldsUpdatedOnSelect,
+    &kAndroidAutofillSuppressOffscreenDatalist,
 };
 
 }  // namespace
@@ -49,6 +50,11 @@
 BASE_FEATURE(kAndroidAutofillFieldsUpdatedOnSelect,
              base::FEATURE_ENABLED_BY_DEFAULT);
 
+// If enabled, datalist popups are suppressed when the field is outside the
+// container view's visible bounds.
+BASE_FEATURE(kAndroidAutofillSuppressOffscreenDatalist,
+             base::FEATURE_ENABLED_BY_DEFAULT);
+
 static int64_t JNI_AndroidAutofillFeatures_GetFeature(JNIEnv* env,
                                                       int32_t ordinal) {
   return reinterpret_cast<int64_t>(kFeaturesExposedToJava[ordinal]);
diff --git a/components/android_autofill/browser/android_autofill_features.h b/components/android_autofill/browser/android_autofill_features.h
index 116208bf..5a1784b2 100644
--- a/components/android_autofill/browser/android_autofill_features.h
+++ b/components/android_autofill/browser/android_autofill_features.h
@@ -16,6 +16,8 @@
 BASE_DECLARE_FEATURE(kAndroidAutofillUpdateContextForWebContents);
 
 BASE_DECLARE_FEATURE(kAndroidAutofillFieldsUpdatedOnSelect);
+
+BASE_DECLARE_FEATURE(kAndroidAutofillSuppressOffscreenDatalist);
 }  // namespace autofill::features
 
 #endif  // COMPONENTS_ANDROID_AUTOFILL_BROWSER_ANDROID_AUTOFILL_FEATURES_H_
diff --git a/components/android_autofill/browser/java/src/org/chromium/components/autofill/AndroidAutofillFeatures.java b/components/android_autofill/browser/java/src/org/chromium/components/autofill/AndroidAutofillFeatures.java
index 1c1b90a..52766ca 100644
--- a/components/android_autofill/browser/java/src/org/chromium/components/autofill/AndroidAutofillFeatures.java
+++ b/components/android_autofill/browser/java/src/org/chromium/components/autofill/AndroidAutofillFeatures.java
@@ -25,6 +25,8 @@
             "AndroidAutofillImprovedVisibilityDetection";
     public static final String ANDROID_AUTOFILL_FIELDS_UPDATED_ON_SELECT_NAME =
             "AndroidAutofillFieldsUpdatedOnSelect";
+    public static final String ANDROID_AUTOFILL_SUPPRESS_OFFSCREEN_DATALIST_NAME =
+            "AndroidAutofillSuppressOffscreenDatalist";
 
     public static final AndroidAutofillFeatures ANDROID_AUTOFILL_LAZY_FRAMEWORK_WRAPPER =
             new AndroidAutofillFeatures(0, ANDROID_AUTOFILL_LAZY_FRAMEWORK_WRAPPER_NAME);
@@ -32,6 +34,8 @@
             new AndroidAutofillFeatures(1, ANDROID_AUTOFILL_IMPROVED_VISIBILITY_DETECTION_NAME);
     public static final AndroidAutofillFeatures ANDROID_AUTOFILL_FIELDS_UPDATED_ON_SELECT =
             new AndroidAutofillFeatures(2, ANDROID_AUTOFILL_FIELDS_UPDATED_ON_SELECT_NAME);
+    public static final AndroidAutofillFeatures ANDROID_AUTOFILL_SUPPRESS_OFFSCREEN_DATALIST =
+            new AndroidAutofillFeatures(3, ANDROID_AUTOFILL_SUPPRESS_OFFSCREEN_DATALIST_NAME);
 
     private final int mOrdinal;
 
diff --git a/components/android_autofill/browser/java/src/org/chromium/components/autofill/AutofillProvider.java b/components/android_autofill/browser/java/src/org/chromium/components/autofill/AutofillProvider.java
index 51cc103..afa1f8e 100644
--- a/components/android_autofill/browser/java/src/org/chromium/components/autofill/AutofillProvider.java
+++ b/components/android_autofill/browser/java/src/org/chromium/components/autofill/AutofillProvider.java
@@ -667,12 +667,23 @@
     }
 
     /**
-     * Display the simplest popup for the datalist. This is same as WebView's datalist popup in
+     * Displays the simplest popup for the datalist. This is same as WebView's datalist popup in
      * Android pre-o. No suggestion from the autofill service will be presented, No advance features
-     * of AutofillPopup are used.
+     * of AutofillPopup are used. Does nothing if {@code bounds} lie entirely outside the container
+     * view's visible area.
      */
     private void showDatalistPopup(
             String[] datalistValues, String[] datalistLabels, RectF bounds, boolean isRtl) {
+        // Suppress the popup if the field is entirely outside the visible bounds of the container
+        // view; renderer-supplied bounds could otherwise place the dropdown over browser or
+        // embedder UI (crbug.com/562236428). We clamp the anchor bounds themselves rather than
+        // FocusField.absBound.
+        @Nullable Rect clampedBounds = clampToVisibleBounds(transformToWindowBounds(bounds));
+        if (AndroidAutofillFeatures.ANDROID_AUTOFILL_SUPPRESS_OFFSCREEN_DATALIST.isEnabled()
+                && (clampedBounds == null || clampedBounds.isEmpty())) {
+            hideDatalistPopup();
+            return;
+        }
         mDatalistSuggestions = new AutofillDropdownItem[datalistValues.length];
         for (int i = 0; i < mDatalistSuggestions.length; i++) {
             mDatalistSuggestions[i] =
@@ -805,6 +816,10 @@
         return mDatalistPopup;
     }
 
+    void setDatalistPopupForTesting(AutofillPopup datalistPopup) {
+        mDatalistPopup = datalistPopup;
+    }
+
     private int getToolbarOffset() {
         return mWebContents != null
                 ? RenderCoordinates.fromWebContents(mWebContents).getContentOffsetYPixInt()
diff --git a/components/android_autofill/browser/junit/src/org/chromium/components/autofill/AutofillProviderTest.java b/components/android_autofill/browser/junit/src/org/chromium/components/autofill/AutofillProviderTest.java
index 489c6990..9249e46 100644
--- a/components/android_autofill/browser/junit/src/org/chromium/components/autofill/AutofillProviderTest.java
+++ b/components/android_autofill/browser/junit/src/org/chromium/components/autofill/AutofillProviderTest.java
@@ -12,6 +12,7 @@
 import static org.junit.Assert.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyBoolean;
+import static org.mockito.ArgumentMatchers.anyFloat;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.doAnswer;
@@ -48,6 +49,7 @@
 import org.chromium.content.browser.RenderCoordinatesImpl;
 import org.chromium.content_public.browser.WebContents;
 import org.chromium.ui.base.ImmutableWeakReference;
+import org.chromium.ui.base.ViewAndroidDelegate;
 import org.chromium.ui.base.WindowAndroid;
 import org.chromium.ui.display.DisplayAndroid;
 
@@ -58,7 +60,8 @@
 /** The unit tests for AutofillProvider. */
 @RunWith(BaseRobolectricTestRunner.class)
 @Features.EnableFeatures({
-    AndroidAutofillFeatures.ANDROID_AUTOFILL_IMPROVED_VISIBILITY_DETECTION_NAME
+    AndroidAutofillFeatures.ANDROID_AUTOFILL_IMPROVED_VISIBILITY_DETECTION_NAME,
+    AndroidAutofillFeatures.ANDROID_AUTOFILL_SUPPRESS_OFFSCREEN_DATALIST_NAME,
 })
 public class AutofillProviderTest {
     private static final float EXPECTED_DIP_SCALE = 2;
@@ -87,6 +90,8 @@
     @Mock private AutofillProvider.Natives mNativeMock;
     @Mock private RenderCoordinatesImpl mRenderCoordinates;
     @Mock private AutofillManager mAutofillManager;
+    @Mock private ViewAndroidDelegate mViewAndroidDelegate;
+    @Mock private View mAnchorView;
 
     /** AutofillManagerWrapper which keeps track of the virtual id of the field with focus. */
     private class TestAutofillManagerWrapper extends AutofillManagerWrapper {
@@ -123,6 +128,37 @@
         }
     }
 
+    private void setContainerScreenGeometry(Rect visibleRect, int screenX, int screenY) {
+        doAnswer(
+                        invocation -> {
+                            Rect rect = invocation.getArgument(0);
+                            rect.set(visibleRect);
+                            return true;
+                        })
+                .when(mContainerView)
+                .getGlobalVisibleRect(any(Rect.class));
+
+        doAnswer(
+                        invocation -> {
+                            int[] location = invocation.getArgument(0);
+                            location[0] = screenX;
+                            location[1] = screenY;
+                            return null;
+                        })
+                .when(mContainerView)
+                .getLocationOnScreen(any());
+
+        doAnswer(
+                        invocation -> {
+                            int[] location = invocation.getArgument(0);
+                            location[0] = screenX;
+                            location[1] = screenY;
+                            return null;
+                        })
+                .when(mContainerView)
+                .getLocationInWindow(any());
+    }
+
     @Before
     public void setUp() {
         mContext = Mockito.mock(Context.class);
@@ -153,34 +189,10 @@
         when(mDisplayAndroid.getDipScale()).thenReturn(EXPECTED_DIP_SCALE);
         when(mContainerView.getScrollX()).thenReturn(SCROLL_X);
         when(mContainerView.getScrollY()).thenReturn(SCROLL_Y);
-        doAnswer(
-                        invocation -> {
-                            int[] location = invocation.getArgument(0);
-                            location[0] = LOCATION_X;
-                            location[1] = LOCATION_Y;
-                            return null;
-                        })
-                .when(mContainerView)
-                .getLocationOnScreen(any());
+        when(mWebContents.getViewAndroidDelegate()).thenReturn(mViewAndroidDelegate);
+        when(mViewAndroidDelegate.acquireView()).thenReturn(mAnchorView);
 
-        doAnswer(
-                        invocation -> {
-                            Rect rect = invocation.getArgument(0);
-                            rect.set(0, 0, 2000, 2000);
-                            return true;
-                        })
-                .when(mContainerView)
-                .getGlobalVisibleRect(any(Rect.class));
-
-        doAnswer(
-                        invocation -> {
-                            int[] location = invocation.getArgument(0);
-                            location[0] = LOCATION_X;
-                            location[1] = LOCATION_Y;
-                            return null;
-                        })
-                .when(mContainerView)
-                .getLocationInWindow(any());
+        setContainerScreenGeometry(new Rect(0, 0, 2000, 2000), LOCATION_X, LOCATION_Y);
 
         RenderCoordinatesImpl.setInstanceForTesting(mRenderCoordinates);
         when(mRenderCoordinates.getContentOffsetYPixInt()).thenReturn(0);
@@ -457,35 +469,7 @@
 
     @Test
     public void testSuppressNotificationOutsideBounds() {
-        // Mock container view to be at [0, 0, 100, 100] on screen
-        doAnswer(
-                        invocation -> {
-                            Rect rect = invocation.getArgument(0);
-                            rect.set(0, 0, 100, 100);
-                            return true;
-                        })
-                .when(mContainerView)
-                .getGlobalVisibleRect(any(Rect.class));
-
-        doAnswer(
-                        invocation -> {
-                            int[] location = invocation.getArgument(0);
-                            location[0] = 0;
-                            location[1] = 0;
-                            return null;
-                        })
-                .when(mContainerView)
-                .getLocationOnScreen(any());
-
-        doAnswer(
-                        invocation -> {
-                            int[] location = invocation.getArgument(0);
-                            location[0] = 0;
-                            location[1] = 0;
-                            return null;
-                        })
-                .when(mContainerView)
-                .getLocationInWindow(any());
+        setContainerScreenGeometry(new Rect(0, 0, 100, 100), 0, 0);
 
         // Reset mFocusVirtualId and mFocusBounds
         mFocusVirtualId = 0;
@@ -536,35 +520,7 @@
 
     @Test
     public void testSuppressNotificationOutsideBoundsWithOffsetY() {
-        // Mock container view to be at [0, 0, 100, 100] on screen.
-        doAnswer(
-                        invocation -> {
-                            Rect rect = invocation.getArgument(0);
-                            rect.set(0, 0, 100, 100);
-                            return true;
-                        })
-                .when(mContainerView)
-                .getGlobalVisibleRect(any(Rect.class));
-
-        doAnswer(
-                        invocation -> {
-                            int[] location = invocation.getArgument(0);
-                            location[0] = 0;
-                            location[1] = 0;
-                            return null;
-                        })
-                .when(mContainerView)
-                .getLocationOnScreen(any());
-
-        doAnswer(
-                        invocation -> {
-                            int[] location = invocation.getArgument(0);
-                            location[0] = 0;
-                            location[1] = 0;
-                            return null;
-                        })
-                .when(mContainerView)
-                .getLocationInWindow(any());
+        setContainerScreenGeometry(new Rect(0, 0, 100, 100), 0, 0);
 
         // Set offset Y to 40. Effective visible bounds top should be 40.
         when(mRenderCoordinates.getContentOffsetYPixInt()).thenReturn(40);
@@ -629,6 +585,215 @@
     }
 
     @Test
+    public void testShowDatalistPopup_suppressedWhenOutsideVisibleBounds() {
+        setContainerScreenGeometry(new Rect(0, 0, 100, 100), 0, 0);
+
+        Activity activity = Mockito.mock(Activity.class);
+        mAutofillProvider.switchToContext(new WeakReference<>(activity));
+
+        // Field is entirely outside the visible container bounds (e.g. top: -2000px).
+        // Datalist anchor uses field bounds: [0, -2000, 100, -1900] * dipScale 2 ->
+        // [0, -4000, 200, -3800], outside [0, 0, 100, 100].
+        RectF offscreenBounds = new RectF(0, -2000, 100, -1900);
+        FormFieldDataBuilder fieldBuilder = new FormFieldDataBuilder();
+        fieldBuilder.mBounds = offscreenBounds;
+
+        FormData form =
+                new FormData(
+                        /* sessionId= */ 123,
+                        /* name= */ null,
+                        /* host= */ null,
+                        Collections.singletonList(fieldBuilder.build()));
+
+        mAutofillProvider.startAutofillSession(
+                form,
+                /* focus= */ 0,
+                offscreenBounds.left,
+                offscreenBounds.top,
+                offscreenBounds.width(),
+                offscreenBounds.height(),
+                /* hasServerPrediction= */ false);
+
+        mAutofillProvider.showDatalistPopup(
+                new String[] {"Value 1"}, new String[] {"Label 1"}, /* isRtl= */ false);
+
+        // When bounds are completely outside visible bounds, popup anchor must not be set
+        // and datalist popup must not be created.
+        verify(mViewAndroidDelegate, never()).acquireView();
+        verify(mNativeMock, never())
+                .setAnchorViewRect(
+                        anyLong(), any(), anyFloat(), anyFloat(), anyFloat(), anyFloat());
+        assertNull(mAutofillProvider.getDatalistPopupForTesting());
+    }
+
+    @Test
+    @Features.DisableFeatures({
+        AndroidAutofillFeatures.ANDROID_AUTOFILL_SUPPRESS_OFFSCREEN_DATALIST_NAME
+    })
... (file diff truncated)