Cross-process iframe accessibility.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/containers/hash_tables.h"
 #include "base/lazy_instance.h"
 #include "base/metrics/histogram.h"
 #include "base/metrics/user_metrics_action.h"
 #include "base/time/time.h"
 #include "content/browser/accessibility/accessibility_mode_helper.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/accessibility/browser_accessibility_state_impl.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/cross_site_transferring_request.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_delegate.h"
 #include "content/browser/frame_host/render_frame_proxy_host.h"
+#include "content/browser/frame_host/render_widget_host_view_child_frame.h"
 #include "content/browser/renderer_host/input/input_router.h"
 #include "content/browser/renderer_host/input/timeout_monitor.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
 #include "content/browser/transition_request_manager.h"
 #include "content/common/accessibility_messages.h"
 #include "content/common/desktop_notification_messages.h"
 #include "content/common/frame_messages.h"
@@ skipping 411 matching lines @@
 
 gfx::NativeViewAccessible
     RenderFrameHostImpl::AccessibilityGetNativeViewAccessible() {
   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
       render_view_host_->GetView());
   if (view)
     return view->AccessibilityGetNativeViewAccessible();
   return NULL;
 }
 
+BrowserAccessibilityManager* RenderFrameHostImpl::AccessibilityGetChildFrame(
+    int64 frame_tree_node_id) {
+  FrameTree* frame_tree = frame_tree_node()->frame_tree();
+  FrameTreeNode* node = frame_tree->FindByID(frame_tree_node_id);
+  if (!node)
+    return NULL;
+
+  RenderFrameHostImpl* render_frame_host = node->current_frame_host();

[Charlie Reis, 2014/08/21 19:23:27]

Should we be concerned if a process swap occurs in one of these frames and the
current_frame_host is different than when we started?  (I'm not sure how
asynchronous this traversal is, or if it all takes place on one pass through the
event loop.)

It might be fine (e.g., we just get the BAM for the most recent frame), but I
want to be sure that doesn't break any assumptions.

[dmazzoni, 2014/08/25 06:49:36]

We're using this safely; when BrowserAccessibilityManager calls any function on
BrowserAccessibilityDelegate, it basically only assumes that return value is
valid within that call stack, it never caches it.

I should probably formalize that contract. I'll add a comment to
BrowserAccessibilityDelegate now.

+  return render_frame_host->GetOrCreateBrowserAccessibilityManager();
+}
+
+BrowserAccessibilityManager*
+RenderFrameHostImpl::AccessibilityGetParentFrame() {
+  FrameTreeNode* parent_node = frame_tree_node()->parent();
+  if (!parent_node)
+    return NULL;
+
+  RenderFrameHostImpl* parent_frame = parent_node->current_frame_host();
+  if (!parent_frame)
+    return NULL;
+
+  return parent_frame->GetOrCreateBrowserAccessibilityManager();
+}
+
 bool RenderFrameHostImpl::CreateRenderFrame(int parent_routing_id) {
   TRACE_EVENT0("frame_host", "RenderFrameHostImpl::CreateRenderFrame");
   DCHECK(!IsRenderFrameLive()) << "Creating frame twice";
 
   // The process may (if we're sharing a process with another host that already
   // initialized it) or may not (we have our own process or the old process
   // crashed) have been initialized. Calling Init multiple times will be
   // ignored, so this is safe.
   if (!GetProcess()->Init())
     return false;
@@ skipping 468 matching lines @@
 
   AccessibilityMode accessibility_mode = delegate_->GetAccessibilityMode();
   if ((accessibility_mode != AccessibilityModeOff) && view &&
       RenderViewHostImpl::IsRVHStateActive(render_view_host_->rvh_state())) {
     if (accessibility_mode & AccessibilityModeFlagPlatform) {
       GetOrCreateBrowserAccessibilityManager();
       if (browser_accessibility_manager_)
         browser_accessibility_manager_->OnAccessibilityEvents(params);
     }
 
+    // Get the frame routing ids from out-of-process iframes and use them
+    // to notify out BrowserAccessibilityManager of the frame tree node id of

[Charlie Reis, 2014/08/21 19:23:27]

nit: out -> our?

[dmazzoni, 2014/08/25 06:49:36]

Done.

+    // any of its child frames.
+    std::map<int32, int>::const_iterator iter;

[Charlie Reis, 2014/08/21 19:23:27]

Can we add a comment about this map being from node IDs to frame routing IDs,
and whether it's purely RenderFrame IDs in the current process or also has
RenderFrameProxy IDs?

[dmazzoni, 2014/08/25 06:49:36]

Done. I think it should allow RenderFrameProxy IDs.

+    for (unsigned int i = 0; i < params.size(); ++i) {
+      const AccessibilityHostMsg_EventParams& param = params[i];
+      for (iter = param.frame_routing_ids.begin();
+           iter != param.frame_routing_ids.end();
+           ++iter) {
+        int32 node_id = iter->first;
+        int frame_routing_id = iter->second;
+
+        RenderFrameHostImpl* child = RenderFrameHostImpl::FromID(
+            GetProcess()->GetID(), frame_routing_id);

[Charlie Reis, 2014/08/21 19:23:27]

How does this work for iframes that are already out of process?  Wouldn't they
have RenderFrameProxies in the renderer process, such that the routing ID would
be a proxy and this would return NULL?

(I'm assuming that we're looping over a set of nodeID -> frameRoutingID pairs
from a given renderer process, and I'm wondering what happens when that process
has RenderFrameProxies.)

[dmazzoni, 2014/08/25 06:49:36]

Agreed, this should handle RenderFrameProxyHosts too. Done.

+        if (browser_accessibility_manager_) {
+          browser_accessibility_manager_->SetChildFrameId(
+              node_id, child->frame_tree_node()->frame_tree_node_id());
+        }
+      }
+    }
+
+    // Send the updates to the automation extension API.
     std::vector<AXEventNotificationDetails> details;
     details.reserve(params.size());
     for (size_t i = 0; i < params.size(); ++i) {
       const AccessibilityHostMsg_EventParams& param = params[i];
       AXEventNotificationDetails detail(param.update.node_id_to_clear,
                                         param.update.nodes,
                                         param.event_type,
                                         param.id,
                                         GetProcess()->GetID(),
                                         routing_id_);
       details.push_back(detail);
     }
 
     delegate_->AccessibilityEventReceived(details);
   }
 
   // Always send an ACK or the renderer can be in a bad state.
   Send(new AccessibilityMsg_Events_ACK(routing_id_));
 
   // The rest of this code is just for testing; bail out if we're not
   // in that mode.
   if (accessibility_testing_callback_.is_null())
     return;
 
   for (size_t i = 0; i < params.size(); i++) {
     const AccessibilityHostMsg_EventParams& param = params[i];
     if (static_cast<int>(param.event_type) < 0)
       continue;
+
     if (!ax_tree_for_testing_) {
-      ax_tree_for_testing_.reset(new ui::AXTree(param.update));
+      if (browser_accessibility_manager_) {
+        ax_tree_for_testing_.reset(new ui::AXTree(
+            browser_accessibility_manager_->SnapshotAXTreeForTesting()));
+      } else {
+        ax_tree_for_testing_.reset(new ui::AXTree());
+        CHECK(ax_tree_for_testing_->Unserialize(param.update))
+            << ax_tree_for_testing_->error();
+      }
     } else {
       CHECK(ax_tree_for_testing_->Unserialize(param.update))
           << ax_tree_for_testing_->error();
     }
     accessibility_testing_callback_.Run(param.event_type, param.id);
   }
 }
 
 void RenderFrameHostImpl::OnAccessibilityLocationChanges(
     const std::vector<AccessibilityHostMsg_LocationChangeParams>& params) {
@@ skipping 252 matching lines @@
 }
 
 void RenderFrameHostImpl::CancelSuspendedNavigations() {
   // Clear any state if a pending navigation is canceled or preempted.
   if (suspended_nav_params_)
     suspended_nav_params_.reset();
   navigations_suspended_ = false;
 }
 
 }  // namespace content