Make sure Document::updateLayoutTree*() is called before Element::isFocusable().

third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp

Index: third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
diff --git a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
index 06aafbcab4efdc8f313282d56e07b9c5c912143a..e8a60d8448656def99306770033d35ec740fedf0 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXNodeObject.cpp
@@ -518,8 +518,11 @@ AccessibilityRole AXNodeObject::determineAccessibilityRole()
         return role;
     if (node()->isElementNode()) {
         Element* element = toElement(node());
-        if (element->isInCanvasSubtree() && element->isFocusable())
-            return GroupRole;
+        if (element->isInCanvasSubtree()) {
+            document()->updateLayoutTreeIgnorePendingStylesheets();

[dmazzoni, 2016/02/04 04:10:56]

I'm worried that this could trigger bugs - this could get called from inside the
call stack of an AXLayoutObject and a call to updateLayoutTree...() could end up
deleting the AXLayoutObject's layoutObject out from under it, potentially
leading to a crash or UAF.

For the purposes of accessibility, we can safely ignore
layoutObjectIsFocusable() - we just need to know whether the DOM supports focus
and is not inert. (We already have layout object visibility checks that happen
later, when we know layout is clean.)

What would you think about adding something like
isFocusableIgnoringLayoutTree()?

[tkent, 2016/02/04 05:47:32]

I think this is safe.
 - It seems AXLayoutObject doesn't use
AXNodeObject::determineAccessibilityRole().
 - Even if AXLayoutObject does, layout tree must be up to date when
determineAccessibilityRole() is called and
updateLayoutTreeIgnorePendingStyleSheets() does nothing.

I think adding isFocusableIgnoringLayoutTree() is hard because
Node::hasEditableStyle() depends on layout tree, and probably ax code wants to
know editability.

+            if (element->isFocusable())
+                return GroupRole;
+        }
     }
     return UnknownRole;
 }