Fix a case where the accessible bounding box of an inline text box was wrong.

third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp

 /*
  * Copyright (C) 2013, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 48 matching lines @@
     AXObject::detach();
     m_inlineTextBox = nullptr;
 }
 
 void AXInlineTextBox::getRelativeBounds(AXObject** outContainer, FloatRect& outBoundsInContainer, SkMatrix44& outContainerTransform) const
 {
     *outContainer = nullptr;
     outBoundsInContainer = FloatRect();
     outContainerTransform.setIdentity();
 
-    if (!m_inlineTextBox)
+    if (!m_inlineTextBox || !parentObject() || !parentObject()->getLayoutObject())

[chrishtr, 2016/09/26 23:42:51]

Why are these conditionals needed?

[dmazzoni, 2016/09/27 16:07:47]

In general, accessibility objects outlive layout objects and
this code could get triggered during teardown, so I'd rather
not assume parentObject() or parentObject->getLayoutObject()
must be valid if we have m_inlineTextBox.

Does it seem redundant?

         return;
 
     *outContainer = parentObject();
     outBoundsInContainer = FloatRect(m_inlineTextBox->localBounds());
+    LayoutObject* parentLayoutObject = parentObject()->getLayoutObject();
+    outBoundsInContainer.moveBy(-parentLayoutObject->localBoundingBoxRectForAccessibility().location());
 }
 
 bool AXInlineTextBox::computeAccessibilityIsIgnored(IgnoredReasons* ignoredReasons) const
 {
     AXObject* parent = parentObject();
     if (!parent)
         return false;
 
     if (!parent->accessibilityIsIgnored())
         return false;
@@ skipping 92 matching lines @@
     if (previousOnLine)
         return m_axObjectCache->getOrCreate(previousOnLine.get());
 
     if (!m_inlineTextBox->isFirst())
         return 0;
 
     return parentObject()->previousOnLine();
 }
 
 } // namespace blink