DevTools Accessibility pane: fix crash when inspecting shadow roots

third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp

Index: third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp
diff --git a/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp b/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp
index ace24ad3ead43568754da86e591101a32ea3f2c0..bdb5be0394ba7d061b3d4adc0dfd6d39c9ac95ec 100644
--- a/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/InspectorAccessibilityAgent.cpp
@@ -10,6 +10,7 @@
 #include "core/dom/Element.h"
 #include "core/dom/Node.h"
 #include "core/dom/NodeList.h"
+#include "core/dom/shadow/ElementShadow.h"
 #include "core/inspector/IdentifiersFactory.h"
 #include "core/inspector/InspectorDOMAgent.h"
 #include "core/inspector/InspectorStyleSheet.h"
@@ -510,11 +511,14 @@ void InspectorAccessibilityAgent::populateDOMNodeRelatives(
   nodeObject.setChildIds(std::move(childIds));
 
   // Walk up parents until an AXObject can be found.
-  Node* parentNode = FlatTreeTraversal::parent(inspectedDOMNode);

[aboxhall, 2016/12/02 00:30:14]

The crash was here: FlatTreeTraversal explicitly does not deal with ShadowRoots.
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/dom/shado...

+  Node* parentNode = inspectedDOMNode.isShadowRoot()
+                         ? &toShadowRoot(inspectedDOMNode).host()
+                         : FlatTreeTraversal::parent(inspectedDOMNode);
   AXObject* parentAXObject = cache.getOrCreate(parentNode);
   while (parentNode && !parentAXObject) {
-    parentNode = FlatTreeTraversal::parent(inspectedDOMNode);
-    parentAXObject = cache.getOrCreate(parentNode);

[dgozman, 2016/12/02 18:04:16]

Where did this line go?

[aboxhall, 2016/12/02 22:25:11]

Yikes. Replaced.

+    parentNode = parentNode->isShadowRoot()
+                     ? &toShadowRoot(parentNode)->host()
+                     : FlatTreeTraversal::parent(*parentNode);
   };
 
   if (!parentAXObject)
@@ -545,7 +549,20 @@ void InspectorAccessibilityAgent::findDOMNodeChildren(
     Node& inspectedDOMNode,
     std::unique_ptr<protocol::Array<AXNode>>& nodes,
     AXObjectCacheImpl& cache) const {
+  if (inspectedDOMNode.isShadowRoot() &&
+      &parentNode == toShadowRoot(inspectedDOMNode).host()) {
+    childIds->addItem(String::number(kIDForInspectedNodeWithNoAXNode));
+    return;
+  }
   NodeList* childNodes = parentNode.childNodes();
+  if (!childNodes->length() && parentNode.isElementNode()) {
+    Element& parentElement = toElement(parentNode);
+    ElementShadow* elementShadow = parentElement.shadow();
+    if (elementShadow) {
+      ShadowRoot& shadowRoot = elementShadow->youngestShadowRoot();
+      childNodes = shadowRoot.childNodes();
+    }
+  }
   for (size_t i = 0; i < childNodes->length(); ++i) {
     Node* childNode = childNodes->item(i);
     if (childNode == &inspectedDOMNode) {