Add a WebContentsImpl API to snapshot the accessibility tree.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/containers/hash_tables.h"
 #include "base/lazy_instance.h"
@@ skipping 46 matching lines @@
 #include "content/public/browser/permission_type.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_widget_host_view.h"
 #include "content/public/browser/stream_handle.h"
 #include "content/public/browser/user_metrics.h"
 #include "content/public/common/content_constants.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/common/url_utils.h"
 #include "ui/accessibility/ax_tree.h"
+#include "ui/accessibility/ax_tree_update.h"
 #include "url/gurl.h"
 
 #if defined(OS_MACOSX)
 #include "content/browser/frame_host/popup_menu_helper_mac.h"
 #endif
 
 #if defined(ENABLE_MEDIA_MOJO_RENDERER)
 #include "media/mojo/interfaces/media_renderer.mojom.h"
 #include "media/mojo/services/mojo_renderer_service.h"
 #endif
@@ skipping 297 matching lines @@
     IPC_MESSAGE_HANDLER(FrameHostMsg_BeginNavigation,
                         OnBeginNavigation)
     IPC_MESSAGE_HANDLER(FrameHostMsg_DispatchLoad, OnDispatchLoad)
     IPC_MESSAGE_HANDLER(FrameHostMsg_TextSurroundingSelectionResponse,
                         OnTextSurroundingSelectionResponse)
     IPC_MESSAGE_HANDLER(AccessibilityHostMsg_Events, OnAccessibilityEvents)
     IPC_MESSAGE_HANDLER(AccessibilityHostMsg_LocationChanges,
                         OnAccessibilityLocationChanges)
     IPC_MESSAGE_HANDLER(AccessibilityHostMsg_FindInPageResult,
                         OnAccessibilityFindInPageResult)
+    IPC_MESSAGE_HANDLER(AccessibilityHostMsg_SnapshotResponse,
+                        OnAccessibilitySnapshotResponse)
     IPC_MESSAGE_HANDLER(FrameHostMsg_ToggleFullscreen, OnToggleFullscreen)
     // The following message is synthetic and doesn't come from RenderFrame, but
     // from RenderProcessHost.
     IPC_MESSAGE_HANDLER(FrameHostMsg_RenderProcessGone, OnRenderProcessGone)
 #if defined(OS_MACOSX) || defined(OS_ANDROID)
     IPC_MESSAGE_HANDLER(FrameHostMsg_ShowPopup, OnShowPopup)
     IPC_MESSAGE_HANDLER(FrameHostMsg_HidePopup, OnHidePopup)
 #endif
   IPC_END_MESSAGE_MAP()
 
@@ skipping 677 matching lines @@
 
   if (frame_tree_node_->IsMainFrame()) {
     // RenderViewHost/RenderWidgetHost needs to reset some stuff.
     render_view_host_->RendererExited(
         render_view_host_->render_view_termination_status_, exit_code);
 
     render_view_host_->delegate_->RenderViewTerminated(
         render_view_host_, static_cast<base::TerminationStatus>(status),
         exit_code);
   }
+
+  // Execute any pending AX tree snapshot callbacks with an empty response,
+  // since we're never going to get a response from this renderer.
+  for (auto iter = ax_tree_snapshot_callbacks_.begin();
+       iter != ax_tree_snapshot_callbacks_.end();
+       ++iter) {
+    iter->second.Run(ui::AXTreeUpdate());

[Charlie Reis, 2015/04/10 20:18:07]

Sanity check: we've seen security bugs in the past where we've run callbacks
after the objects they store internally are already deleted.  Are we at risk of
that by running this after sending out the RendererExited/Terminated
notifications?

[dmazzoni, 2015/04/10 21:57:12]

Not unless the caller binds the callback to an Unretained pointer or something
dangerous like that. Here's the next changelist that makes use of this callback
and it looks totally safe, the callback is bound to a scoped java ref.

https://codereview.chromium.org/1073983005

[Charlie Reis, 2015/04/10 22:15:46]

I'll have to take your word for it; ScopedJavaGlobalRef is foreign to me.

I was more concerned about things like AXTreeSnapshotCallback in that CL having
a pointer to something that gets deleted before here, or being stored on an
object that gets deleted before here.  Sounds like it's not an immediate
concern.

+  }
+  ax_tree_snapshot_callbacks_.clear();
 }
 
 void RenderFrameHostImpl::OnSwappedOut() {
   // Ignore spurious swap out ack.
   if (rfh_state_ != STATE_PENDING_SWAP_OUT)
     return;
 
   TRACE_EVENT_ASYNC_END0("navigation", "RenderFrameHostImpl::SwapOut", this);
   swapout_event_monitor_timeout_->Stop();
 
@@ skipping 294 matching lines @@
     BrowserAccessibilityManager* manager =
         GetOrCreateBrowserAccessibilityManager();
     if (manager) {
       manager->OnFindInPageResult(
           params.request_id, params.match_index, params.start_id,
           params.start_offset, params.end_id, params.end_offset);
     }
   }
 }
 
+void RenderFrameHostImpl::OnAccessibilitySnapshotResponse(
+    int request_id,

[Charlie Reis, 2015/04/10 20:18:07]

Actually, let's call this callback_id (throughout the CL).  request_id is too
easy to confuse with the tracking of network requests in the loader, which isn't
related to this.

[dmazzoni, 2015/04/10 21:57:12]

Done.

+    const ui::AXTreeUpdate& snapshot) {
+  std::map<int, AXTreeSnapshotCallback>::iterator it =
+      ax_tree_snapshot_callbacks_.find(request_id);
+  if (it != ax_tree_snapshot_callbacks_.end()) {
+    it->second.Run(snapshot);
+    ax_tree_snapshot_callbacks_.erase(it);
+  } else {
+    NOTREACHED() << "Received AX tree snapshot response for unknown request";
+  }
+}
+
 void RenderFrameHostImpl::OnToggleFullscreen(bool enter_fullscreen) {
   if (enter_fullscreen)
     delegate_->EnterFullscreenMode(GetLastCommittedURL().GetOrigin());
   else
     delegate_->ExitFullscreenMode();
 
   // The previous call might change the fullscreen state. We need to make sure
   // the renderer is aware of that, which is done via the resize message.
   render_view_host_->WasResized();
 }
@@ skipping 393 matching lines @@
   // As a sanity check, make sure the frame belongs to the same BrowserContext.
   CHECK_EQ(GetSiteInstance()->GetBrowserContext(),
            other_render_frame_host->GetSiteInstance()->GetBrowserContext());
   return GetSiteInstance() == other_render_frame_host->GetSiteInstance();
 }
 
 void RenderFrameHostImpl::SetAccessibilityMode(AccessibilityMode mode) {
   Send(new FrameMsg_SetAccessibilityMode(routing_id_, mode));
 }
 
+void RenderFrameHostImpl::RequestAXTreeSnapshot(
+    AXTreeSnapshotCallback callback) {
+  static int next_id = 1;
+  int id = next_id++;
+  Send(new AccessibilityMsg_SnapshotTree(routing_id_, id));
+  ax_tree_snapshot_callbacks_.insert(std::make_pair(id, callback));
+}
+
 void RenderFrameHostImpl::SetAccessibilityCallbackForTesting(
     const base::Callback<void(ui::AXEvent, int)>& callback) {
   accessibility_testing_callback_ = callback;
 }
 
 void RenderFrameHostImpl::SetTextTrackSettings(
     const FrameMsg_TextTrackSettings_Params& params) {
   DCHECK(!GetParent());
   Send(new FrameMsg_SetTextTrackSettings(routing_id_, params));
 }
@@ skipping 137 matching lines @@
     return;
 
   permission_manager->RegisterPermissionUsage(
       PermissionType::GEOLOCATION,
       GetLastCommittedURL().GetOrigin(),
       frame_tree_node()->frame_tree()->GetMainFrame()
           ->GetLastCommittedURL().GetOrigin());
 }
 
 }  // namespace content