From f49d058c880110acd4479e6634cc8013e3f672cd Mon Sep 17 00:00:00 2001
From: Fredrik Söderquist <[email protected]>
Date: Mon, 19 Oct 2026 12:37:03 -0700
Subject: [PATCH] Limit image request in HTMLPlugInElement::CustomStyleForLayoutObject

When the ComputedStyle is being ensured we shouldn't perform an image
load.

Fixed: 574101376, 575184164
Change-Id: I7b678074d4496ef667f360cbab62ce7c459b4785
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8611107
Reviewed-by: Rune Lillesveen <[email protected]>
Commit-Queue: Rune Lillesveen <[email protected]>
Auto-Submit: Fredrik Söderquist <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1722229}
---
diff --git a/third_party/blink/renderer/core/html/html_plugin_element.cc b/third_party/blink/renderer/core/html/html_plugin_element.cc
index 5a2002c..e0ee60c 100644
--- a/third_party/blink/renderer/core/html/html_plugin_element.cc
+++ b/third_party/blink/renderer/core/html/html_plugin_element.cc
@@ -36,6 +36,7 @@
 #include "third_party/blink/renderer/bindings/core/v8/to_v8_traits.h"
 #include "third_party/blink/renderer/core/css/css_property_names.h"
 #include "third_party/blink/renderer/core/css/style_change_reason.h"
+#include "third_party/blink/renderer/core/css/style_recalc_context.h"
 #include "third_party/blink/renderer/core/display_lock/display_lock_utilities.h"
 #include "third_party/blink/renderer/core/dom/document.h"
 #include "third_party/blink/renderer/core/dom/events/event.h"
@@ -949,8 +950,9 @@
     const StyleRecalcContext& style_recalc_context) {
   const ComputedStyle* style =
       OriginalStyleForLayoutObject(style_recalc_context);
-  if (IsImageType() && !GetLayoutObject() && style &&
-      LayoutObjectIsNeeded(*style)) {
+  // Don't attempt a load if this computed style is for EnsureComputedStyle().
+  if (!style_recalc_context.is_ensuring_style && IsImageType() &&
+      !GetLayoutObject() && style && LayoutObjectIsNeeded(*style)) {
     if (!image_loader_) {
       image_loader_ = MakeGarbageCollected<HTMLImageLoader>(this);
     }
diff --git a/third_party/blink/renderer/core/html/html_object_element_test.cc b/third_party/blink/renderer/core/html/html_object_element_test.cc
index 7a8e470..cc7812d 100644
--- a/third_party/blink/renderer/core/html/html_object_element_test.cc
+++ b/third_party/blink/renderer/core/html/html_object_element_test.cc
@@ -11,6 +11,8 @@
 #include "third_party/blink/renderer/core/frame/local_frame_view.h"
 #include "third_party/blink/renderer/core/html/html_slot_element.h"
 #include "third_party/blink/renderer/core/testing/dummy_page_holder.h"
+#include "third_party/blink/renderer/core/testing/sim/sim_request.h"
+#include "third_party/blink/renderer/core/testing/sim/sim_test.h"
 #include "third_party/blink/renderer/platform/testing/task_environment.h"
 
 namespace blink {
@@ -50,4 +52,24 @@
   EXPECT_TRUE(slot->GetComputedStyle());
 }
 
+class HTMLObjectElementSimTest : public SimTest {};
+
+TEST_F(HTMLObjectElementSimTest, NoLoadOnEnsureComputedStyle) {
+  SimRequest request("https://example.com/test.html", "text/html");
+  LoadURL("https://example.com/test.html");
+  request.Complete(R"HTML(
+     <!doctype html>
+     <div style='display: none'>
+       <object id='obj' data='file.png' type='image/png'></object>
+     </div>
+  )HTML");
+
+  Element* object = GetElementById("obj");
+  ASSERT_TRUE(object);
+  EXPECT_FALSE(object->GetComputedStyle());
+  object->EnsureComputedStyle();
+  // Pass if no crash (URLLoaderMock DCHECK failure) because of a request being
+  // performed for 'file.png'.
+}
+
 }  // namespace blink