Make sure Document::updateLayoutTree*() is called before Element::isFocusable().

third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp

 /*
  * Copyright (C) 2012, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 500 matching lines @@
     if ((m_ariaRole = determineAriaRoleAttribute()) != UnknownRole)
         return m_ariaRole;
     if (node()->isTextNode())
         return StaticTextRole;
 
     AccessibilityRole role = nativeAccessibilityRoleIgnoringAria();
     if (role != UnknownRole)
         return role;
     if (node()->isElementNode()) {
         Element* element = toElement(node());
-        if (element->isInCanvasSubtree() && element->isFocusable())
-            return GroupRole;
+        if (element->isInCanvasSubtree()) {
+            document()->updateLayoutTreeIgnorePendingStylesheets();

[dmazzoni, 2016/02/04 04:10:56]

I'm worried that this could trigger bugs - this could get called from inside the
call stack of an AXLayoutObject and a call to updateLayoutTree...() could end up
deleting the AXLayoutObject's layoutObject out from under it, potentially
leading to a crash or UAF.

For the purposes of accessibility, we can safely ignore
layoutObjectIsFocusable() - we just need to know whether the DOM supports focus
and is not inert. (We already have layout object visibility checks that happen
later, when we know layout is clean.)

What would you think about adding something like
isFocusableIgnoringLayoutTree()?

[tkent, 2016/02/04 05:47:32]

I think this is safe.
 - It seems AXLayoutObject doesn't use
AXNodeObject::determineAccessibilityRole().
 - Even if AXLayoutObject does, layout tree must be up to date when
determineAccessibilityRole() is called and
updateLayoutTreeIgnorePendingStyleSheets() does nothing.

I think adding isFocusableIgnoringLayoutTree() is hard because
Node::hasEditableStyle() depends on layout tree, and probably ax code wants to
know editability.

+            if (element->isFocusable())
+                return GroupRole;
+        }
     }
     return UnknownRole;
 }
 
 AccessibilityRole AXNodeObject::determineAriaRoleAttribute() const
 {
     const AtomicString& ariaRole = getAttribute(roleAttr);
     if (ariaRole.isNull() || ariaRole.isEmpty())
         return UnknownRole;
 
@@ skipping 2215 matching lines @@
     return placeholder;
 }
 
 DEFINE_TRACE(AXNodeObject)
 {
     visitor->trace(m_node);
     AXObject::trace(visitor);
 }
 
 } // namespace blink