Fix a case where the accessible bounding box of an inline text box was wrong.

third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp

Index: third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
diff --git a/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp b/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
index 925239303cc7af3fd96b5d803a2d546031efdd27..a4df66a74ebafb2be5b03d0cf854d6445318577c 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXInlineTextBox.cpp
@@ -66,11 +66,13 @@ void AXInlineTextBox::getRelativeBounds(AXObject** outContainer, FloatRect& outB
     outBoundsInContainer = FloatRect();
     outContainerTransform.setIdentity();
 
-    if (!m_inlineTextBox)
+    if (!m_inlineTextBox || !parentObject() || !parentObject()->getLayoutObject())

[chrishtr, 2016/09/26 23:42:51]

Why are these conditionals needed?

[dmazzoni, 2016/09/27 16:07:47]

In general, accessibility objects outlive layout objects and
this code could get triggered during teardown, so I'd rather
not assume parentObject() or parentObject->getLayoutObject()
must be valid if we have m_inlineTextBox.

Does it seem redundant?

         return;
 
     *outContainer = parentObject();
     outBoundsInContainer = FloatRect(m_inlineTextBox->localBounds());
+    LayoutObject* parentLayoutObject = parentObject()->getLayoutObject();
+    outBoundsInContainer.moveBy(-parentLayoutObject->localBoundingBoxRectForAccessibility().location());
 }
 
 bool AXInlineTextBox::computeAccessibilityIsIgnored(IgnoredReasons* ignoredReasons) const