Fix accessible touch exploration inside of iframes.

content/renderer/accessibility/renderer_accessibility.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/renderer/accessibility/renderer_accessibility.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <queue>
@@ skipping 366 matching lines @@
 
 void RendererAccessibility::OnHitTest(gfx::Point point) {
   const WebDocument& document = GetMainDocument();
   if (document.isNull())
     return;
   WebAXObject root_obj = document.accessibilityObject();
   if (!root_obj.updateLayoutAndCheckValidity())
     return;
 
   WebAXObject obj = root_obj.hitTest(point);
-  if (!obj.isDetached())
-    HandleAXEvent(obj, ui::AX_EVENT_HOVER);
+  if (obj.isDetached())
+    return;
+
+  // If the object that was hit has a child frame, we have to send a
+  // message back to the browser to do the hit test in the child frame,
+  // recursively.
+  AXContentNodeData data;
+  tree_source_.SerializeNode(obj, &data);
+  if (data.HasContentIntAttribute(AX_CONTENT_ATTR_CHILD_ROUTING_ID) ||
+      data.HasContentIntAttribute(
+          AX_CONTENT_ATTR_CHILD_BROWSER_PLUGIN_INSTANCE_ID)) {
+    Send(new AccessibilityHostMsg_ChildFrameHitTestResult(routing_id(), point,
+                                                          obj.axID()));
+    return;
+  }
+
+  // Otherwise, send a HOVER event on the node that was hit.
+  HandleAXEvent(obj, ui::AX_EVENT_HOVER);
 }
 
 void RendererAccessibility::OnSetAccessibilityFocus(int acc_obj_id) {
   if (tree_source_.accessibility_focus_id() == acc_obj_id)
     return;
 
   tree_source_.set_accessibility_focus_id(acc_obj_id);
 
   const WebDocument& document = GetMainDocument();
   if (document.isNull())
@@ skipping 180 matching lines @@
 #ifndef NDEBUG
     LOG(WARNING) << "ShowContextMenu on invalid object id " << acc_obj_id;
 #endif
     return;
   }
 
   obj.showContextMenu();
 }
 
 }  // namespace content