Fix accessibility with out-of-process iframes.

content/browser/accessibility/browser_accessibility.cc

Index: content/browser/accessibility/browser_accessibility.cc
diff --git a/content/browser/accessibility/browser_accessibility.cc b/content/browser/accessibility/browser_accessibility.cc
index 9d4fe101afc599be1f15caf17a87cdfc0a74103b..514b1fce0b32e7bd958c76002057ae0a035e8d59 100644
--- a/content/browser/accessibility/browser_accessibility.cc
+++ b/content/browser/accessibility/browser_accessibility.cc
@@ -60,6 +60,9 @@ bool BrowserAccessibility::PlatformIsLeaf() const {
 }
 
 uint32 BrowserAccessibility::PlatformChildCount() const {
+  if (HasBoolAttribute(ui::AX_ATTR_IS_AX_TREE_HOST))

[dmazzoni, 2015/06/25 22:15:38]

Not due to your change, but let's change this to GetBoolAttribute instead.
HasBoolAttribute happens to work correctly because we prune attributes whose
value is false, 0, or "" but GetBoolAttribute would be more correct.

More important, though: this needs to call
manager_->delegate()->AccessibilityGetChildFrame and only return 1 if the child
currently exists. It will be common for a parent frame to have a child frame ID
when the child frame isn't loaded yet. If someone calls PlatformChildCount() and
then iterates over the children immediately afterwards from the same thread, it
shouldn't ever get NULL.

[lfg, 2015/06/25 22:48:24]

Done. I also changed the DCHECK below to call this function, since the condition
became more complex.

+    return 1;
+
   return PlatformIsLeaf() ? 0 : InternalChildCount();
 }
 
@@ -80,14 +83,17 @@ bool BrowserAccessibility::IsDescendantOf(
 
 BrowserAccessibility* BrowserAccessibility::PlatformGetChild(
     uint32 child_index) const {
-  DCHECK(child_index < InternalChildCount());
-  BrowserAccessibility* result = InternalGetChild(child_index);
+  DCHECK((child_index == 0 && HasBoolAttribute(ui::AX_ATTR_IS_AX_TREE_HOST)) ||
+         child_index < InternalChildCount());
+  BrowserAccessibility* result = nullptr;
 
-  if (result->HasBoolAttribute(ui::AX_ATTR_IS_AX_TREE_HOST)) {
+  if (HasBoolAttribute(ui::AX_ATTR_IS_AX_TREE_HOST)) {
     BrowserAccessibilityManager* child_manager =
-        manager_->delegate()->AccessibilityGetChildFrame(result->GetId());
+        manager_->delegate()->AccessibilityGetChildFrame(GetId());
     if (child_manager)
       result = child_manager->GetRoot();
+  } else {
+    result = InternalGetChild(child_index);
   }
 
   return result;
@@ -150,7 +156,7 @@ BrowserAccessibility* BrowserAccessibility::GetParent() const {
   if (!host_node)
     return NULL;
 
-  return host_node->GetParent();
+  return host_node;
 }
 
 int32 BrowserAccessibility::GetIndexInParent() const {