Generalized fix for serialization error/reset issues

chrome/renderer/extensions/automation_internal_custom_bindings.cc

Index: chrome/renderer/extensions/automation_internal_custom_bindings.cc
diff --git a/chrome/renderer/extensions/automation_internal_custom_bindings.cc b/chrome/renderer/extensions/automation_internal_custom_bindings.cc
index e8c836dfa1cb2ffd6637298af57ef0c415cd012a..4e9a450e974daaf3ab25244b3afb333988e09a43 100644
--- a/chrome/renderer/extensions/automation_internal_custom_bindings.cc
+++ b/chrome/renderer/extensions/automation_internal_custom_bindings.cc
@@ -995,7 +995,7 @@ void AutomationInternalCustomBindings::GetState(
 
   v8::Local<v8::Object> state(v8::Object::New(isolate));
   uint32_t state_pos = 0, state_shifter = node->data().state;
-  while (state_shifter) {
+  while (state_shifter && state_shifter <= ui::AX_STATE_LAST) {

[dmazzoni, 2016/11/22 18:11:42]

Is this related?

[David Tseng, 2016/11/22 18:26:28]

Somewhat. When toggling off/on, we get incomplete tree data and among other
things, start accessing bogous state values.

     if (state_shifter & 1) {
       std::string key = ToString(static_cast<ui::AXState>(state_pos));
       state->Set(CreateV8String(isolate, key), v8::Boolean::New(isolate, true));
@@ -1157,8 +1157,16 @@ void AutomationInternalCustomBindings::OnAccessibilityEvent(
   // Update the internal state whether it's the active profile or not.
   cache->location_offset = params.location_offset;
   deleted_node_ids_.clear();
+  v8::Isolate* isolate = GetIsolate();
+  v8::HandleScope handle_scope(isolate);
+  v8::Context::Scope context_scope(context()->v8_context());
+  v8::Local<v8::Array> args(v8::Array::New(GetIsolate(), 1U));
   if (!cache->tree.Unserialize(params.update)) {
     LOG(ERROR) << cache->tree.error();
+    args->Set(0U,
+              v8::Number::New(isolate, tree_id));

[dmazzoni, 2016/11/22 18:11:42]

nit: fits on one line

[David Tseng, 2016/11/22 18:26:28]

Done.

+    context()->DispatchEvent(
+        "automationInternal.onAccessibilityTreeSerializationError", args);
     return;
   }
 
@@ -1169,10 +1177,6 @@ void AutomationInternalCustomBindings::OnAccessibilityEvent(
   SendNodesRemovedEvent(&cache->tree, deleted_node_ids_);
   deleted_node_ids_.clear();
 
-  v8::Isolate* isolate = GetIsolate();
-  v8::HandleScope handle_scope(isolate);
-  v8::Context::Scope context_scope(context()->v8_context());
-  v8::Local<v8::Array> args(v8::Array::New(GetIsolate(), 1U));
   v8::Local<v8::Object> event_params(v8::Object::New(GetIsolate()));
   event_params->Set(CreateV8String(isolate, "treeID"),
                     v8::Integer::New(GetIsolate(), params.tree_id));