Fix crash in InspectorCSSAgent::ResetPseudoStates

node_id_to_number_focused_children_ could contain not only Element
instances resulting in a DCHECK failure when a non-element node
was converted to Element using To<Element> in
InspectorCSSAgent::ResetPseudoStates. This resulted in a crash
on ChromeOS and stack buffer overflow on other platforms.

Fixed: 1123526
Change-Id: I7d29f4813ced44be7303e8c6060750863cf0851a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2403473Reviewed-by: Sigurd Schneider <sigurds@chromium.org>
Commit-Queue: Alex Rudenko <alexrudenko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#806143}

third_party/blink/renderer/core/inspector/inspector_css_agent.cc

@@ -1728,6 +1728,8 @@ Response InspectorCSSAgent::forcePseudoState(
 
 void InspectorCSSAgent::IncrementFocusedCountForAncestors(Element* element) {
   for (Node& ancestor : FlatTreeTraversal::AncestorsOf(*element)) {
+    if (!IsA<Element>(ancestor))
+      continue;
     int node_id = dom_agent_->BoundNodeId(&ancestor);
     if (!node_id)
       continue;
@@ -1741,6 +1743,8 @@ void InspectorCSSAgent::IncrementFocusedCountForAncestors(Element* element) {
 
 void InspectorCSSAgent::DecrementFocusedCountForAncestors(Element* element) {
   for (Node& ancestor : FlatTreeTraversal::AncestorsOf(*element)) {
+    if (!IsA<Element>(ancestor))
+      continue;
     int node_id = dom_agent_->BoundNodeId(&ancestor);
     if (!node_id)
       continue;

third_party/blink/web_tests/inspector-protocol/css/css-force-focus-pseudo-state-expected.txt

+Test CSS.forcePseudoStates method for focus
+Color without forced focus: rgb(0, 0, 0)
+Color with forced focus: rgb(0, 0, 255)
+Didn't fail after disabling the CSS agent (https://crbug.com/1123526).
+

third_party/blink/web_tests/inspector-protocol/css/css-force-focus-pseudo-state-shadow-root-expected.txt

+Test CSS.forcePseudoStates method for :focus setting :focus-within state across shadow root boundaries
+Shadow mode: open
+#inner background color without forced focus: default
+#host border without forced focus: 0px none rgb(0, 0, 0)
+#inner background color with forced focus:  background: red; 
+#host border with forced focus: 1px solid rgb(0, 0, 0)
+Shadow mode: closed
+#inner background color without forced focus: default
+#host border without forced focus: 0px none rgb(0, 0, 0)
+#inner background color with forced focus:  background: red; 
+#host border with forced focus: 1px solid rgb(0, 0, 0)
+

third_party/blink/web_tests/inspector-protocol/css/css-force-focus-pseudo-state-shadow-root.js

+(async function(testRunner) {
+  const {session, dp} = await testRunner.startHTML(`
+  <style>
+    #host:focus-within {
+      border: 1px solid black;
+    }
+  </style>
+  <template id="tmpl">
+    <style> #inner:focus { background: red; } </style>
+    <input id="inner" value="hi!"></input>
+  </template>
+  <div id="host"></div>
+  `, 'Test CSS.forcePseudoStates method for :focus setting :focus-within state across shadow root boundaries');
+
+  const CSSHelper = await testRunner.loadScript('../resources/css-helper.js');
+  const cssHelper = new CSSHelper(testRunner, dp);
+
+  await dp.DOM.enable();
+  await dp.CSS.enable();
+
+  for (const mode of ['open', 'closed']) {
+    testRunner.log(`Shadow mode: ${mode}`);
+    await session.evaluate(() => {
+      // Reset the #host element by re-creating it.
+      document.body.removeChild(document.querySelector('#host'));
+      const newHost = document.createElement('div');
+      newHost.id = 'host';
+      document.body.appendChild(newHost)
+    });
+
+    const documentNodeId = await cssHelper.requestDocumentNodeId();
+    await cssHelper.requestNodeId(documentNodeId, '#host');
+
+    session.evaluate((mode) => {
+      const shadowRoot = document.querySelector('#host').attachShadow({mode});
+      const template = document.querySelector('#tmpl');
+      const clone = document.importNode(template.content, true);
+      shadowRoot.appendChild(clone);
+    }, mode);
+
+    const shadowRootPushed = await dp.DOM.onceShadowRootPushed();
+    const nodeId = await cssHelper.requestNodeId(shadowRootPushed.params.root.nodeId, '#inner');
+
+    async function getInnerBackgroudColor() {
+      const { result } = await dp.CSS.getMatchedStylesForNode({ nodeId });
+      const matchedRule = result.matchedCSSRules.find(match => match.rule.selectorList.text== '#inner:focus');
+      if (!matchedRule) {
+        return 'default';
+      }
+      return matchedRule.rule.style.cssText;
+    }
+
+    async function getHostBorder() {
+      return await session.evaluate(() => {
+        return window.getComputedStyle(document.querySelector('#host')).border;
+      });
+    }
+
+    testRunner.log("#inner background color without forced focus: " + await getInnerBackgroudColor());
+    testRunner.log("#host border without forced focus: " + await getHostBorder());
+
+    await dp.CSS.forcePseudoState({nodeId, forcedPseudoClasses: ['focus']});
+
+    testRunner.log("#inner background color with forced focus: " + await getInnerBackgroudColor());
+    testRunner.log("#host border with forced focus: " + await getHostBorder());
+  }
+
+  testRunner.completeTest();
+});

third_party/blink/web_tests/inspector-protocol/css/css-force-focus-pseudo-state.js

+(async function(testRunner) {
+  const {session, dp} = await testRunner.startHTML(`
+    <style>
+      #target:focus {
+        color: blue;
+      }
+    </style>
+    <div id="target">test</div>
+  `, 'Test CSS.forcePseudoStates method for focus');
+
+  await dp.DOM.enable();
+  await dp.CSS.enable();
+
+  const CSSHelper = await testRunner.loadScript('../resources/css-helper.js');
+  const cssHelper = new CSSHelper(testRunner, dp);
+
+  const documentNodeId = await cssHelper.requestDocumentNodeId();
+  const nodeId = await cssHelper.requestNodeId(documentNodeId, '#target');
+
+  async function getTargetColor() {
+    return await session.evaluate(() => {
+      return window.getComputedStyle(document.querySelector('#target')).color;
+    });
+  }
+
+  testRunner.log("Color without forced focus: " + await getTargetColor());
+
+  await dp.CSS.forcePseudoState({nodeId, forcedPseudoClasses: ['focus']});
+
+  testRunner.log("Color with forced focus: " + await getTargetColor());
+
+  await dp.CSS.disable();
+  await dp.DOM.disable();
+
+  testRunner.log("Didn't fail after disabling the CSS agent (https://crbug.com/1123526).");
+
+  testRunner.completeTest();
+});