Add a test that confirms there's no crash on accessing properties of AccesibilityObject at the init…

Source/web/WebAXObject.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 685 matching lines @@
 WebAXRole WebAXObject::role() const
 {
     if (isDetached())
         return blink::WebAXRoleUnknown;
 
     return static_cast<WebAXRole>(m_private->roleValue());
 }
 
 unsigned WebAXObject::selectionEnd() const
 {
+    if (m_private->isTextControl())

[dmazzoni, 2014/03/28 06:30:32]

I'm assuming this fixes the crash, but it doesn't make sense and isn't helpful
to fix it here. Can you find the underlying cause of the crash? I'm assuming
it's in AXRenderObject.cpp or further downstream.

[hajimehoshi, 2014/03/28 06:45:08]

I agree with you.

The cause is that there is an assertion at AXRendererObject::selectedTextRange
(https://code.google.com/p/chromium/codesearch#chromium/src/third_party/WebKit...),
while AXRendererObject::selectedTextRange could be accessed from any kinds of
AXRendererObjects. I'm afraid I wan't sure these asserts could be eliminated.

BTW, a similar code exists at
https://code.google.com/p/chromium/codesearch#chromium/src/content/renderer/a...
in terms of 'if' check before accessing proprties.

+        return 0;
+
     if (isDetached())
         return 0;
 
     return m_private->selectedTextRange().start + m_private->selectedTextRange().length;
 }
 
 unsigned WebAXObject::selectionStart() const
 {
+    if (m_private->isTextControl())
+        return 0;
+
     if (isDetached())
         return 0;
 
     return m_private->selectedTextRange().start;
 }
 
 unsigned WebAXObject::selectionEndLineNumber() const
 {
     if (isDetached())
         return 0;
@@ skipping 18 matching lines @@
 }
 
 void WebAXObject::setFocused(bool on) const
 {
     if (!isDetached())
         m_private->setFocused(on);
 }
 
 void WebAXObject::setSelectedTextRange(int selectionStart, int selectionEnd) const
 {
+    if (m_private->isTextControl())
+        return;
+
     if (isDetached())
         return;
 
     m_private->setSelectedTextRange(AXObject::PlainTextRange(selectionStart, selectionEnd - selectionStart));
 }
 
 WebString WebAXObject::stringValue() const
 {
     if (isDetached())
         return WebString();
@@ skipping 393 matching lines @@
     m_private = object;
     return *this;
 }
 
 WebAXObject::operator WTF::PassRefPtr<WebCore::AXObject>() const
 {
     return m_private.get();
 }
 
 } // namespace blink