DevTools Accessibility pane: fix crash when inspecting shadow roots

third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/accessibility/InspectorAccessibilityAgent.h"
 
 #include "core/HTMLNames.h"
 #include "core/dom/AXObjectCache.h"
 #include "core/dom/DOMNodeIds.h"
 #include "core/dom/Element.h"
 #include "core/dom/Node.h"
 #include "core/dom/NodeList.h"
+#include "core/dom/shadow/ElementShadow.h"
 #include "core/inspector/IdentifiersFactory.h"
 #include "core/inspector/InspectorDOMAgent.h"
 #include "core/inspector/InspectorStyleSheet.h"
 #include "core/page/Page.h"
 #include "modules/accessibility/AXObject.h"
 #include "modules/accessibility/AXObjectCacheImpl.h"
 #include "modules/accessibility/InspectorTypeBuilderHelper.h"
 #include <memory>
 
 namespace blink {
@@ skipping 480 matching lines @@
     std::unique_ptr<protocol::Array<AXNode>>& nodes,
     AXObjectCacheImpl& cache) const {
   // Populate children.
   std::unique_ptr<protocol::Array<AXNodeId>> childIds =
       protocol::Array<AXNodeId>::create();
   findDOMNodeChildren(childIds, inspectedDOMNode, inspectedDOMNode, nodes,
                       cache);
   nodeObject.setChildIds(std::move(childIds));
 
   // Walk up parents until an AXObject can be found.
-  Node* parentNode = FlatTreeTraversal::parent(inspectedDOMNode);

[aboxhall, 2016/12/02 00:30:14]

The crash was here: FlatTreeTraversal explicitly does not deal with ShadowRoots.
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/dom/shado...

+  Node* parentNode = inspectedDOMNode.isShadowRoot()
+                         ? &toShadowRoot(inspectedDOMNode).host()
+                         : FlatTreeTraversal::parent(inspectedDOMNode);
   AXObject* parentAXObject = cache.getOrCreate(parentNode);
   while (parentNode && !parentAXObject) {
-    parentNode = FlatTreeTraversal::parent(inspectedDOMNode);
-    parentAXObject = cache.getOrCreate(parentNode);

[dgozman, 2016/12/02 18:04:16]

Where did this line go?

[aboxhall, 2016/12/02 22:25:11]

Yikes. Replaced.

+    parentNode = parentNode->isShadowRoot()
+                     ? &toShadowRoot(parentNode)->host()
+                     : FlatTreeTraversal::parent(*parentNode);
   };
 
   if (!parentAXObject)
     return;
 
   if (parentAXObject->accessibilityIsIgnored())
     parentAXObject = parentAXObject->parentObjectUnignored();
   if (!parentAXObject)
     return;
 
@@ skipping 10 matching lines @@
   if (grandparentAXObject)
     addAncestors(*grandparentAXObject, nullptr, nodes, cache);
 }
 
 void InspectorAccessibilityAgent::findDOMNodeChildren(
     std::unique_ptr<protocol::Array<AXNodeId>>& childIds,
     Node& parentNode,
     Node& inspectedDOMNode,
     std::unique_ptr<protocol::Array<AXNode>>& nodes,
     AXObjectCacheImpl& cache) const {
+  if (inspectedDOMNode.isShadowRoot() &&
+      &parentNode == toShadowRoot(inspectedDOMNode).host()) {
+    childIds->addItem(String::number(kIDForInspectedNodeWithNoAXNode));
+    return;
+  }
   NodeList* childNodes = parentNode.childNodes();
+  if (!childNodes->length() && parentNode.isElementNode()) {
+    Element& parentElement = toElement(parentNode);
+    ElementShadow* elementShadow = parentElement.shadow();
+    if (elementShadow) {
+      ShadowRoot& shadowRoot = elementShadow->youngestShadowRoot();
+      childNodes = shadowRoot.childNodes();
+    }
+  }
   for (size_t i = 0; i < childNodes->length(); ++i) {
     Node* childNode = childNodes->item(i);
     if (childNode == &inspectedDOMNode) {
       childIds->addItem(String::number(kIDForInspectedNodeWithNoAXNode));
       continue;
     }
 
     AXObject* childAXObject = cache.getOrCreate(childNode);
     if (childAXObject) {
       if (childAXObject->accessibilityIsIgnored()) {
@@ skipping 207 matching lines @@
   }
 }
 
 DEFINE_TRACE(InspectorAccessibilityAgent) {
   visitor->trace(m_page);
   visitor->trace(m_domAgent);
   InspectorBaseAgent::trace(visitor);
 }
 
 }  // namespace blink