Fix accessibility with out-of-process iframes.

content/renderer/accessibility/blink_ax_tree_source.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/accessibility/blink_ax_tree_source.h"
 
 #include <set>
 
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/string_util.h"
@@ skipping 19 matching lines @@
 #include "third_party/WebKit/public/web/WebPlugin.h"
 #include "third_party/WebKit/public/web/WebPluginContainer.h"
 #include "third_party/WebKit/public/web/WebView.h"
 
 using base::ASCIIToUTF16;
 using base::UTF16ToUTF8;
 using blink::WebAXObject;
 using blink::WebDocument;
 using blink::WebDocumentType;
 using blink::WebElement;
-using blink::WebLocalFrame;
+using blink::WebFrame;
 using blink::WebNode;
 using blink::WebPlugin;
 using blink::WebPluginContainer;
 using blink::WebVector;
 using blink::WebView;
 
 namespace content {
 
 namespace {
 
@@ skipping 363 matching lines @@
 
     // Browser plugin (used in a <webview>).
     if (node_to_browser_plugin_instance_id_map_) {
       BrowserPlugin* browser_plugin = BrowserPlugin::GetFromNode(element);
       if (browser_plugin) {
         (*node_to_browser_plugin_instance_id_map_)[dst->id] =
             browser_plugin->browser_plugin_instance_id();
         dst->AddBoolAttribute(ui::AX_ATTR_IS_AX_TREE_HOST, true);
       }
     }
+
+    // Out-of-process iframe.
+    if (is_iframe && node_to_frame_routing_id_map_) {
+      WebFrame* frame = WebFrame::fromFrameOwnerElement(element);
+
+      if (frame->isWebRemoteFrame()) {

[michaeln, 2015/07/01 20:57:10]

looks like |frame| is sometimes null here and this line crashes

+        RenderFrameProxy* render_frame_proxy =
+            RenderFrameProxy::FromWebFrame(frame);
+
+        DCHECK(render_frame_proxy);
+        (*node_to_frame_routing_id_map_)[dst->id] =
+            render_frame_proxy->routing_id();
+        dst->AddBoolAttribute(ui::AX_ATTR_IS_AX_TREE_HOST, true);
+      }
+    }
   }
 
   if (src.isInLiveRegion()) {
     dst->AddBoolAttribute(ui::AX_ATTR_LIVE_ATOMIC, src.liveRegionAtomic());
     dst->AddBoolAttribute(ui::AX_ATTR_LIVE_BUSY, src.liveRegionBusy());
     if (src.liveRegionBusy())
       dst->state |= (1 << ui::AX_STATE_BUSY);
     if (!src.liveRegionStatus().isEmpty()) {
       dst->AddStringAttribute(ui::AX_ATTR_LIVE_STATUS,
                               UTF16ToUTF8(src.liveRegionStatus()));
@@ skipping 36 matching lines @@
     dst->AddBoolAttribute(ui::AX_ATTR_DOC_LOADED, src.isLoaded());
     dst->AddFloatAttribute(ui::AX_ATTR_DOC_LOADING_PROGRESS,
                            src.estimatedLoadingProgress());
 
     const WebDocumentType& doctype = document.doctype();
     if (!doctype.isNull()) {
       dst->AddStringAttribute(ui::AX_ATTR_DOC_DOCTYPE,
                               UTF16ToUTF8(doctype.name()));
     }
 
-    if (node_to_frame_routing_id_map_ && !src.equals(GetRoot())) {
-      WebLocalFrame* frame = document.frame();
-      RenderFrameImpl* render_frame = RenderFrameImpl::FromWebFrame(frame);
-      if (render_frame) {
-        (*node_to_frame_routing_id_map_)[dst->id] =
-            render_frame->GetRoutingID();
-        dst->AddBoolAttribute(ui::AX_ATTR_IS_AX_TREE_HOST, true);
-      } else {
-        RenderFrameProxy* render_frame_proxy =
-            RenderFrameProxy::FromWebFrame(frame);
-        if (render_frame_proxy) {
-          (*node_to_frame_routing_id_map_)[dst->id] =
-              render_frame_proxy->routing_id();
-          dst->AddBoolAttribute(ui::AX_ATTR_IS_AX_TREE_HOST, true);
-        }
-      }
-    }
   }
 
   if (dst->role == ui::AX_ROLE_TABLE) {
     int column_count = src.columnCount();
     int row_count = src.rowCount();
     if (column_count > 0 && row_count > 0) {
       std::set<int32> unique_cell_id_set;
       std::vector<int32> cell_ids;
       std::vector<int32> unique_cell_ids;
       dst->AddIntAttribute(ui::AX_ATTR_TABLE_COLUMN_COUNT, column_count);
@@ skipping 109 matching lines @@
   }
 }
 
 blink::WebDocument BlinkAXTreeSource::GetMainDocument() const {
   if (render_frame_ && render_frame_->GetWebFrame())
     return render_frame_->GetWebFrame()->document();
   return WebDocument();
 }
 
 }  // namespace content