Fix accessibility with out-of-process iframes.

content/renderer/accessibility/blink_ax_tree_source.cc

Index: content/renderer/accessibility/blink_ax_tree_source.cc
diff --git a/content/renderer/accessibility/blink_ax_tree_source.cc b/content/renderer/accessibility/blink_ax_tree_source.cc
index addc5758f1655b49c81747ff6d97e20860f7c601..95615354d288cd0868ceaeec8f9609cd9d348b81 100644
--- a/content/renderer/accessibility/blink_ax_tree_source.cc
+++ b/content/renderer/accessibility/blink_ax_tree_source.cc
@@ -37,7 +37,7 @@ using blink::WebAXObject;
 using blink::WebDocument;
 using blink::WebDocumentType;
 using blink::WebElement;
-using blink::WebLocalFrame;
+using blink::WebFrame;
 using blink::WebNode;
 using blink::WebPlugin;
 using blink::WebPluginContainer;
@@ -421,6 +421,21 @@ void BlinkAXTreeSource::SerializeNode(blink::WebAXObject src,
         dst->AddBoolAttribute(ui::AX_ATTR_IS_AX_TREE_HOST, true);
       }
     }
+
+    // Out-of-process iframe.
+    if (is_iframe && node_to_frame_routing_id_map_) {
+      WebFrame* frame = WebFrame::fromFrameOwnerElement(element);
+
+      if (frame->isWebRemoteFrame()) {

[michaeln, 2015/07/01 20:57:10]

looks like |frame| is sometimes null here and this line crashes

+        RenderFrameProxy* render_frame_proxy =
+            RenderFrameProxy::FromWebFrame(frame);
+
+        DCHECK(render_frame_proxy);
+        (*node_to_frame_routing_id_map_)[dst->id] =
+            render_frame_proxy->routing_id();
+        dst->AddBoolAttribute(ui::AX_ATTR_IS_AX_TREE_HOST, true);
+      }
+    }
   }
 
   if (src.isInLiveRegion()) {
@@ -477,23 +492,6 @@ void BlinkAXTreeSource::SerializeNode(blink::WebAXObject src,
                               UTF16ToUTF8(doctype.name()));
     }
 
-    if (node_to_frame_routing_id_map_ && !src.equals(GetRoot())) {
-      WebLocalFrame* frame = document.frame();
-      RenderFrameImpl* render_frame = RenderFrameImpl::FromWebFrame(frame);
-      if (render_frame) {
-        (*node_to_frame_routing_id_map_)[dst->id] =
-            render_frame->GetRoutingID();
-        dst->AddBoolAttribute(ui::AX_ATTR_IS_AX_TREE_HOST, true);
-      } else {
-        RenderFrameProxy* render_frame_proxy =
-            RenderFrameProxy::FromWebFrame(frame);
-        if (render_frame_proxy) {
-          (*node_to_frame_routing_id_map_)[dst->id] =
-              render_frame_proxy->routing_id();
-          dst->AddBoolAttribute(ui::AX_ATTR_IS_AX_TREE_HOST, true);
-        }
-      }
-    }
   }
 
   if (dst->role == ui::AX_ROLE_TABLE) {