Generalized fix for serialization error/reset issues

chrome/renderer/extensions/automation_internal_custom_bindings.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/renderer/extensions/automation_internal_custom_bindings.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <memory>
@@ skipping 977 matching lines @@
   TreeCache* cache = GetTreeCacheFromTreeID(tree_id);
   if (!cache)
     return;
 
   ui::AXNode* node = cache->tree.GetFromId(node_id);
   if (!node)
     return;
 
   v8::Local<v8::Object> state(v8::Object::New(isolate));
   uint32_t state_pos = 0, state_shifter = node->data().state;
-  while (state_shifter) {
+  while (state_shifter && state_shifter <= ui::AX_STATE_LAST) {

[dmazzoni, 2016/11/22 18:11:42]

Is this related?

[David Tseng, 2016/11/22 18:26:28]

Somewhat. When toggling off/on, we get incomplete tree data and among other
things, start accessing bogous state values.

     if (state_shifter & 1) {
       std::string key = ToString(static_cast<ui::AXState>(state_pos));
       state->Set(CreateV8String(isolate, key), v8::Boolean::New(isolate, true));
     }
     state_shifter = state_shifter >> 1;
     state_pos++;
   }
 
   TreeCache* top_cache = GetTreeCacheFromTreeID(0);
   if (!top_cache)
@@ skipping 141 matching lines @@
     cache->owner = this;
     tree_id_to_tree_cache_map_.insert(std::make_pair(tree_id, cache));
     axtree_to_tree_cache_map_.insert(std::make_pair(&cache->tree, cache));
   } else {
     cache = iter->second;
   }
 
   // Update the internal state whether it's the active profile or not.
   cache->location_offset = params.location_offset;
   deleted_node_ids_.clear();
+  v8::Isolate* isolate = GetIsolate();
+  v8::HandleScope handle_scope(isolate);
+  v8::Context::Scope context_scope(context()->v8_context());
+  v8::Local<v8::Array> args(v8::Array::New(GetIsolate(), 1U));
   if (!cache->tree.Unserialize(params.update)) {
     LOG(ERROR) << cache->tree.error();
+    args->Set(0U,
+              v8::Number::New(isolate, tree_id));

[dmazzoni, 2016/11/22 18:11:42]

nit: fits on one line

[David Tseng, 2016/11/22 18:26:28]

Done.

+    context()->DispatchEvent(
+        "automationInternal.onAccessibilityTreeSerializationError", args);
     return;
   }
 
   // Don't send any events if it's not the active profile.
   if (!is_active_profile)
     return;
 
   SendNodesRemovedEvent(&cache->tree, deleted_node_ids_);
   deleted_node_ids_.clear();
 
-  v8::Isolate* isolate = GetIsolate();
-  v8::HandleScope handle_scope(isolate);
-  v8::Context::Scope context_scope(context()->v8_context());
-  v8::Local<v8::Array> args(v8::Array::New(GetIsolate(), 1U));
   v8::Local<v8::Object> event_params(v8::Object::New(GetIsolate()));
   event_params->Set(CreateV8String(isolate, "treeID"),
                     v8::Integer::New(GetIsolate(), params.tree_id));
   event_params->Set(CreateV8String(isolate, "targetID"),
                     v8::Integer::New(GetIsolate(), params.id));
   event_params->Set(CreateV8String(isolate, "eventType"),
                     CreateV8String(isolate, ToString(params.event_type)));
   event_params->Set(CreateV8String(isolate, "eventFrom"),
                     CreateV8String(isolate, ToString(params.event_from)));
   event_params->Set(CreateV8String(isolate, "mouseX"),
@@ skipping 226 matching lines @@
   v8::Local<v8::Array> args(v8::Array::New(GetIsolate(), 2U));
   args->Set(0U, v8::Integer::New(GetIsolate(), tree_id));
   v8::Local<v8::Array> nodes(v8::Array::New(GetIsolate(), ids.size()));
   args->Set(1U, nodes);
   for (size_t i = 0; i < ids.size(); ++i)
     nodes->Set(i, v8::Integer::New(GetIsolate(), ids[i]));
   context()->DispatchEvent("automationInternal.onNodesRemoved", args);
 }
 
 }  // namespace extensions