Cross-process iframe accessibility.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/containers/hash_tables.h"
 #include "base/lazy_instance.h"
 #include "base/metrics/histogram.h"
 #include "base/metrics/user_metrics_action.h"
 #include "base/time/time.h"
 #include "content/browser/accessibility/accessibility_mode_helper.h"
 #include "content/browser/accessibility/browser_accessibility_manager.h"
 #include "content/browser/accessibility/browser_accessibility_state_impl.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/browser/frame_host/cross_process_frame_connector.h"
 #include "content/browser/frame_host/cross_site_transferring_request.h"
 #include "content/browser/frame_host/frame_tree.h"
 #include "content/browser/frame_host/frame_tree_node.h"
 #include "content/browser/frame_host/navigator.h"
 #include "content/browser/frame_host/render_frame_host_delegate.h"
 #include "content/browser/frame_host/render_frame_proxy_host.h"
+#include "content/browser/frame_host/render_widget_host_view_child_frame.h"
 #include "content/browser/renderer_host/input/input_router.h"
 #include "content/browser/renderer_host/input/timeout_monitor.h"
 #include "content/browser/renderer_host/render_process_host_impl.h"
 #include "content/browser/renderer_host/render_view_host_delegate.h"
 #include "content/browser/renderer_host/render_view_host_delegate_view.h"
 #include "content/browser/renderer_host/render_view_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_impl.h"
 #include "content/browser/renderer_host/render_widget_host_view_base.h"
 #include "content/browser/transition_request_manager.h"
 #include "content/common/accessibility_messages.h"
@@ skipping 421 matching lines @@
 
 gfx::NativeViewAccessible
     RenderFrameHostImpl::AccessibilityGetNativeViewAccessible() {
   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
       render_view_host_->GetView());
   if (view)
     return view->AccessibilityGetNativeViewAccessible();
   return NULL;
 }
 
+BrowserAccessibilityManager* RenderFrameHostImpl::AccessibilityGetChildFrame(
+    int64 frame_tree_node_id) {
+  FrameTree* frame_tree = frame_tree_node()->frame_tree();
+  FrameTreeNode* node = frame_tree->FindByID(frame_tree_node_id);

[Charlie Reis, 2014/08/27 17:28:34]

This will probably do for now, but it would be nice to think about whether
there's a more elegant way to walk the FrameTree in parallel with the
accessibility tree.

At the moment, we're linearly searching the FrameTree every time we encounter an
OOPIF in the accessibility tree, making it O(n^2), where n is the number of
OOPIFs in the FrameTree.  (It's not O(n log n) because it's not a binary
search.)  We should be able to walk the two trees in parallel visiting each node
once, in O(n) time.

I'm not terribly concerned about this, given that n (and even the size of the
FrameTree including same-site frames) is likely to be very small.  Still, we
should come up with a better pattern for similar features to follow.

At the very least, I just noticed that we already have
FrameTree::GloballyFindByID with a global hash_map of frames.  That would give
us an O(1) lookup without even needing to go through this RFH's FrameTree.

[dmazzoni, 2014/08/28 05:40:14]

Oh, I never would have guessed that it wasn't storing that in a hash map. Is
there any reason not to just maintain a hash map from frame tree node id to
frame tree node, local to each frame tree?
Good thought.

I switched to using GloballyFindByID followed by a check that we got a node in
the same frame tree. That look better?

[Charlie Reis, 2014/08/28 18:18:51]

We were adding tree accessors as they were needed, and the use cases were mainly
traversals where the map wouldn't help much.  A more recent use case needed the
global lookup.

Now that we have the global map, we could probably change FrameTree::FindByID to
use it (returning null if the result is from a different tree).  No need to do
that in this CL unless you're feeling particularly proactive.
Yes, that's great.  The CHECK is fine if we never expect to pass in a value from
a different tree, but if an exploited renderer could confuse us, then we should
probably just return null.

+  if (!node)
+    return NULL;
+
+  RenderFrameHostImpl* render_frame_host = node->current_frame_host();
+  return render_frame_host->GetOrCreateBrowserAccessibilityManager();
+}
+
+BrowserAccessibilityManager*
+RenderFrameHostImpl::AccessibilityGetParentFrame() {
+  FrameTreeNode* parent_node = frame_tree_node()->parent();
+  if (!parent_node)
+    return NULL;
+
+  RenderFrameHostImpl* parent_frame = parent_node->current_frame_host();
+  if (!parent_frame)
+    return NULL;
+
+  return parent_frame->GetOrCreateBrowserAccessibilityManager();
+}
+
 bool RenderFrameHostImpl::CreateRenderFrame(int parent_routing_id) {
   TRACE_EVENT0("frame_host", "RenderFrameHostImpl::CreateRenderFrame");
   DCHECK(!IsRenderFrameLive()) << "Creating frame twice";
 
   // The process may (if we're sharing a process with another host that already
   // initialized it) or may not (we have our own process or the old process
   // crashed) have been initialized. Calling Init multiple times will be
   // ignored, so this is safe.
   if (!GetProcess()->Init())
     return false;
@@ skipping 468 matching lines @@
 
   AccessibilityMode accessibility_mode = delegate_->GetAccessibilityMode();
   if ((accessibility_mode != AccessibilityModeOff) && view &&
       RenderViewHostImpl::IsRVHStateActive(render_view_host_->rvh_state())) {
     if (accessibility_mode & AccessibilityModeFlagPlatform) {
       GetOrCreateBrowserAccessibilityManager();
       if (browser_accessibility_manager_)
         browser_accessibility_manager_->OnAccessibilityEvents(params);
     }
 
+    if (browser_accessibility_manager_) {
+      // Get the frame routing ids from out-of-process iframes and use them
+      // to notify our BrowserAccessibilityManager of the frame tree node id of
+      // any of its child frames.
+      for (unsigned int i = 0; i < params.size(); ++i) {
+        const AccessibilityHostMsg_EventParams& param = params[i];
+        std::map<int32, int>::const_iterator iter;
+        for (iter = param.node_to_frame_routing_id_map.begin();
+             iter != param.node_to_frame_routing_id_map.end();
+             ++iter) {
+          // This is the id of the accessibility node that has a child frame.
+          int32 node_id = iter->first;
+          // The routing id from either a RenderFrame or a RenderFrameProxy.
+          int frame_routing_id = iter->second;
+
+          RenderFrameHostImpl* child = RenderFrameHostImpl::FromID(

[Charlie Reis, 2014/08/27 17:28:35]

Here's another block that FrameTree should be providing: a way to look up a
FrameTreeNode given a process ID and routing ID, whether it's a RenderFrameHost
or a RenderFrameProxyHost.

In fact, we're already most of the way there.  FrameTree::FindByRoutingID has a
TODO to search the "swapped out RFHs" as well, which today means searching the
RenderFrameProxyHosts.  Can we update and use that, since we expect future
callers to need it as well?

(We can probably make that efficient using the two RFH/RFPH FromID methods and
then double-checking that the result actually belongs to the FrameTree in
question.)

[dmazzoni, 2014/08/28 05:40:14]

Good idea! Is this what you had in mind?

[Charlie Reis, 2014/08/28 18:18:51]

Perfect!

+              GetProcess()->GetID(), frame_routing_id);
+          if (child) {
+            browser_accessibility_manager_->SetChildFrameTreeNodeId(
+                node_id, child->frame_tree_node()->frame_tree_node_id());
+          } else {
+            RenderFrameProxyHost* child_proxy = RenderFrameProxyHost::FromID(
+                GetProcess()->GetID(), frame_routing_id);
+            if (child_proxy) {
+              browser_accessibility_manager_->SetChildFrameTreeNodeId(
+                  node_id,
+                  child_proxy->frame_tree_node()->frame_tree_node_id());
+            }
+          }
+        }
+      }
+    }
+
+    // Send the updates to the automation extension API.
     std::vector<AXEventNotificationDetails> details;
     details.reserve(params.size());
     for (size_t i = 0; i < params.size(); ++i) {
       const AccessibilityHostMsg_EventParams& param = params[i];
       AXEventNotificationDetails detail(param.update.node_id_to_clear,
                                         param.update.nodes,
                                         param.event_type,
                                         param.id,
                                         GetProcess()->GetID(),
                                         routing_id_);
       details.push_back(detail);
     }
 
     delegate_->AccessibilityEventReceived(details);
   }
 
   // Always send an ACK or the renderer can be in a bad state.
   Send(new AccessibilityMsg_Events_ACK(routing_id_));
 
   // The rest of this code is just for testing; bail out if we're not
   // in that mode.
   if (accessibility_testing_callback_.is_null())
     return;
 
   for (size_t i = 0; i < params.size(); i++) {
     const AccessibilityHostMsg_EventParams& param = params[i];
     if (static_cast<int>(param.event_type) < 0)
       continue;
+
     if (!ax_tree_for_testing_) {
-      ax_tree_for_testing_.reset(new ui::AXTree(param.update));
+      if (browser_accessibility_manager_) {
+        ax_tree_for_testing_.reset(new ui::AXTree(
+            browser_accessibility_manager_->SnapshotAXTreeForTesting()));
+      } else {
+        ax_tree_for_testing_.reset(new ui::AXTree());
+        CHECK(ax_tree_for_testing_->Unserialize(param.update))
+            << ax_tree_for_testing_->error();
+      }
     } else {
       CHECK(ax_tree_for_testing_->Unserialize(param.update))
           << ax_tree_for_testing_->error();
     }
     accessibility_testing_callback_.Run(param.event_type, param.id);
   }
 }
 
 void RenderFrameHostImpl::OnAccessibilityLocationChanges(
     const std::vector<AccessibilityHostMsg_LocationChangeParams>& params) {
@@ skipping 309 matching lines @@
 }
 
 void RenderFrameHostImpl::CancelSuspendedNavigations() {
   // Clear any state if a pending navigation is canceled or preempted.
   if (suspended_nav_params_)
     suspended_nav_params_.reset();
   navigations_suspended_ = false;
 }
 
 }  // namespace content