tree e59e05310cd97a2916c5046596956c4f56684c55
parent e4273baa5708f48b9a493831fbe38e071f684887
author Daniel Vogelheim <vogelheim@chromium.org> 1713535279 -0700
committer Blink WPT Bot <blink-w3c-test-autoroller@chromium.org> 1713536395 -0700

Fix use of stale index when a Trusted Type callback modifies attributes.

SetAttributeHinted is implemented in terms of an index into the
AttributeCollection. Obtaining the index happens before the TT callback,
with a subsequent usage afterwards. If the callback modifies the
elements' attributes, e.g. by deleting one of them, the index may
no longer be accurate.

This fix adds a check for that situation, and re-calculcates the index
if necessary.

Bug: 333739948
Change-Id: Id38d6e45afd2e5b3ff48da3b1d4c79ec7e118ef6
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5447533
Reviewed-by: Yifan Luo <lyf@chromium.org>
Commit-Queue: Daniel Vogelheim <vogelheim@chromium.org>
Reviewed-by: Mason Freed <masonf@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1289901}