Implement accessibility support for CSS-transformed iframes.

third_party/WebKit/Source/modules/accessibility/AXLayoutObject.cpp

 /*
 * Copyright (C) 2008 Apple Inc. All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1.  Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 62 matching lines @@
 #include "core/svg/SVGDocumentExtensions.h"
 #include "core/svg/SVGSVGElement.h"
 #include "core/svg/graphics/SVGImage.h"
 #include "modules/accessibility/AXImageMapLink.h"
 #include "modules/accessibility/AXInlineTextBox.h"
 #include "modules/accessibility/AXObjectCacheImpl.h"
 #include "modules/accessibility/AXSVGRoot.h"
 #include "modules/accessibility/AXSpinButton.h"
 #include "modules/accessibility/AXTable.h"
 #include "platform/fonts/FontTraits.h"
+#include "platform/geometry/TransformState.h"
 #include "platform/text/PlatformLocale.h"
 #include "platform/text/TextDirection.h"
 #include "wtf/StdLibExtras.h"
 
 using blink::WebLocalizedString;
 
 namespace blink {
 
 using namespace HTMLNames;
 
@@ skipping 118 matching lines @@
             toAXLayoutObject(obj)->checkCachedElementRect();
     }
     for (const AXObject* obj = this; obj; obj = obj->parentObject()) {
         if (obj->isAXLayoutObject())
             toAXLayoutObject(obj)->updateCachedElementRect();
     }
 
     return m_cachedElementRect;
 }
 
+SkMatrix44 AXLayoutObject::transformFromLocalParentFrame() const
+{
+    if (!m_layoutObject || !documentFrameView() || !documentFrameView()->layoutView())

[dcheng, 2016/03/23 05:26:00]

I'm a little surprised we need the latter two checks: shouldn't having a
LayoutObject imply the existence of the FrameView and LayoutView?

[dmazzoni, 2016/03/24 04:26:53]

What about during tear-down? We've been bitten by bugs before when an
accessibility APi gets called during frame tear-down.

If you're sure it's still impossible I can remove these checks

[dcheng, 2016/03/24 04:33:14]

I guess I don't know enough about how AX hooks in to say this will be true for
sure.

Are there any preconditions around when AXObject::detach() is invoked? Is there
a guarantee that this will happen synchronously when a node is detached from the
DOM?

[dmazzoni, 2016/03/24 04:50:07]

Yes, it happens synchronously, in Node::removedFrom.

Come to think of it, the past problems we had probably all involved weird corner
cases (usually found by clusterfuzz) involving multiple frames. Now that we know
that all of the AXObjects belong to the same document and frame, this ought to
be
a lot more safe.

After reading the code for documentFrameView() and layoutView() I'm comfortable
removing those checks.

+        return SkMatrix44();
+    LayoutView* layoutView = documentFrameView()->layoutView();
+
+    FrameView* parentFrameView = documentFrameView()->parentFrameView();
+    if (!parentFrameView || !parentFrameView->layoutView())

[dcheng, 2016/03/23 05:26:00]

Similar thought about the null check for parentFrameView->layoutView() here.

[dmazzoni, 2016/03/24 04:50:07]

Done.

+        return SkMatrix44();
+    LayoutView* parentLayoutView = parentFrameView->layoutView();
+
+    TransformationMatrix accumulatedTransform = layoutView->localToAncestorTransform(parentLayoutView, TraverseDocumentBoundaries);
+    IntPoint scrollPosition = documentFrameView()->scrollPosition();
+    accumulatedTransform.translate(scrollPosition.x(), scrollPosition.y());
+    return TransformationMatrix::toSkMatrix44(accumulatedTransform);
+}
+
 LayoutBoxModelObject* AXLayoutObject::getLayoutBoxModelObject() const
 {
     if (!m_layoutObject || !m_layoutObject->isBoxModelObject())
         return 0;
     return toLayoutBoxModelObject(m_layoutObject);
 }
 
 bool AXLayoutObject::shouldNotifyActiveDescendant() const
 {
     // We want to notify that the combo box has changed its active descendant,
@@ skipping 2277 matching lines @@
         if (label && label->layoutObject()) {
             LayoutRect labelRect = axObjectCache().getOrCreate(label)->elementRect();
             result.unite(labelRect);
         }
     }
 
     return result;
 }
 
 } // namespace blink