Take a snapshot of the AXTree

content/browser/web_contents/web_contents_android.cc

Index: content/browser/web_contents/web_contents_android.cc
diff --git a/content/browser/web_contents/web_contents_android.cc b/content/browser/web_contents/web_contents_android.cc
index 4afd1e8ef374a23e17328d889ce461cb213edc60..8c0284156be6045addc65d1b78ae10a50a18ffed 100644
--- a/content/browser/web_contents/web_contents_android.cc
+++ b/content/browser/web_contents/web_contents_android.cc
@@ -5,10 +5,13 @@
 #include "content/browser/web_contents/web_contents_android.h"
 
 #include "base/android/jni_android.h"
+#include "base/android/jni_array.h"
 #include "base/android/jni_string.h"
 #include "base/command_line.h"
 #include "base/json/json_writer.h"
 #include "base/logging.h"
+#include "content/browser/accessibility/browser_accessibility_android.h"
+#include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/android/interstitial_page_delegate_android.h"
 #include "content/browser/frame_host/interstitial_page_impl.h"
 #include "content/browser/media/android/browser_media_player_manager.h"
@@ -25,12 +28,15 @@
 #include "content/public/common/content_switches.h"
 #include "jni/WebContentsImpl_jni.h"
 #include "net/android/network_library.h"
+#include "ui/accessibility/ax_node_data.h"
 
 using base::android::AttachCurrentThread;
 using base::android::ConvertJavaStringToUTF8;
 using base::android::ConvertJavaStringToUTF16;
 using base::android::ConvertUTF8ToJavaString;
+using base::android::ConvertUTF16ToJavaString;
 using base::android::ScopedJavaGlobalRef;
+using base::android::ToJavaIntArray;
 
 namespace {
 
@@ -44,6 +50,44 @@ void JavaScriptResultCallback(const ScopedJavaGlobalRef<jobject>& callback,
       env, j_json.obj(), callback.obj());
 }
 
+ScopedJavaLocalRef<jobject> WalkAXTreeDepthFirst(JNIEnv* env,
+      content::BrowserAccessibilityAndroid* node) {
+
+  ScopedJavaLocalRef<jstring> j_text =
+      ConvertUTF16ToJavaString(env,node->GetText());
+  ScopedJavaLocalRef<jstring> j_class =
+      ConvertUTF8ToJavaString(env,node->GetClassName());
+  const gfx::Rect& location = node->GetLocation();
+  ScopedJavaLocalRef<jobject> j_node =
+      content::Java_WebContentsImpl_createAXNode(env,
+          node->GetId(), location.x(), location.y(), node->GetScrollX(),
+          node->GetScrollY(), location.width(), location.height(),
+          j_text.obj(), j_class.obj());
+
+  for(uint32 i = 0; i < node->PlatformChildCount(); i++) {
+    content::BrowserAccessibilityAndroid* child =
+        static_cast<content::BrowserAccessibilityAndroid*>(
+            node->PlatformGetChild(i));
+    content::Java_WebContentsImpl_addAXNodeAsChild(env,
+        j_node.obj(), WalkAXTreeDepthFirst(env, child).obj());
+  }
+  return j_node;
+}
+
+
+void AXTreeSnapshotCallback(const ScopedJavaGlobalRef<jobject>& callback,
+                            const ui::AXTreeUpdate& result) {
+  JNIEnv* env = base::android::AttachCurrentThread();
+  scoped_ptr<content::BrowserAccessibilityManager> manager(
+      content::BrowserAccessibilityManager::Create(result, nullptr));
+  content::BrowserAccessibilityAndroid* root =
+      static_cast<content::BrowserAccessibilityAndroid*>(manager->GetRoot());
+  // TODO(sgurun) check if root can be null here.

[dmazzoni, 2015/04/10 19:20:00]

You should probably first check if result.nodes is empty and consider that a
failure if so.

Otherwise, BrowserAccessibilityManager will parse the AXTreeUpdate and it will
always have a valid root if so.

I just realize that if it fails to parse it either calls the delegate if it has
one, or exits with a fatal error if not, so you may want to consider whether you
want to provide a delegate.

There's no valid reason you should get a bad AXTreeUpdate, it's just a question
of if you have a compromised or corrupted renderer if you want to return an
error or just crash the whole program.

[sgurun-gerrit only, 2015/04/10 23:24:50]

Thanks, for webview we probably don't worry too much about a corrupted renderer
case since webview is single process, and if renderer is compromised/corrupted a
crash is likely imminent anyway. checked for the condition result.nodes is
empty.

[boliu, 2015/04/10 23:47:17]

Drive by meta-comment:

Single-process-ness of webview is irrelevant here. This is content code that is
multi-process in clank.

Also it's just generally bad even in webview-only code trust information from
renderer. We should follow chrome's pattern of checking as well.

+  ScopedJavaLocalRef<jobject> j_root = WalkAXTreeDepthFirst(env, root);
+  content::Java_WebContentsImpl_onAXTreeSnapshot(
+      env, j_root.obj(), callback.obj());
+}
+
 void ReleaseAllMediaPlayers(content::WebContents* web_contents,
                             content::RenderFrameHost* render_frame_host) {
   content::BrowserMediaPlayerManager* manager =
@@ -506,4 +550,18 @@ jint WebContentsAndroid::GetThemeColor(JNIEnv* env, jobject obj) {
   return web_contents_->GetThemeColor();
 }
 
+void WebContentsAndroid::RequestAXTreeSnapshot(JNIEnv* env,
+                                               jobject obj,
+                                               jobject callback) {
+  // Secure the Java callback in a scoped object and give ownership of it to the
+  // base::Callback.
+  ScopedJavaGlobalRef<jobject> j_callback;
+  j_callback.Reset(env, callback);
+  content::WebContentsImpl::AXTreeSnapshotCallback snapshot_callback =
+      base::Bind(&AXTreeSnapshotCallback, j_callback);
+
+  static_cast<WebContentsImpl*>(web_contents_)->RequestAXTreeSnapshot(
+      snapshot_callback);
+}
+
 }  // namespace content