Fixed IAccessible::accNavigate for NAVDIR_NEXT and NAVDIR_PREVIOUS when start object was a simple c…

ui/accessibility/platform/ax_platform_node_win.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <atlbase.h>
 #include <atlcom.h>
 #include <limits.h>
 #include <oleacc.h>
 #include <stdint.h>
 
@@ skipping 320 matching lines @@
   if (bounds.IsEmpty())
     return S_FALSE;
 
   return S_OK;
 }
 
 STDMETHODIMP AXPlatformNodeWin::accNavigate(
     LONG nav_dir, VARIANT start, VARIANT* end) {
   AXPlatformNodeWin* target;
   COM_OBJECT_VALIDATE_VAR_ID_1_ARG_AND_GET_TARGET(start, end, target);
-  IAccessible* result = nullptr;
-
-  if ((nav_dir == NAVDIR_LASTCHILD || nav_dir == NAVDIR_FIRSTCHILD) &&
-      start.lVal != CHILDID_SELF) {
+  end->vt = VT_EMPTY;
+  if ((nav_dir == NAVDIR_FIRSTCHILD || nav_dir == NAVDIR_LASTCHILD) &&
+      V_VT(&start) == VT_I4 && V_I4(&start) != CHILDID_SELF) {
     // MSAA states that navigating to first/last child can only be from self.
     return E_INVALIDARG;
   }
 
+  IAccessible* result = nullptr;
   switch (nav_dir) {
     case NAVDIR_DOWN:
     case NAVDIR_UP:
     case NAVDIR_LEFT:
     case NAVDIR_RIGHT:
-      // These directions are not implemented, matching Mozilla and IE.
+      // These directions are not implemented except in tables.
       return E_NOTIMPL;
 
     case NAVDIR_FIRSTCHILD:
       if (delegate_->GetChildCount() > 0)
         result = delegate_->ChildAtIndex(0);
       break;
 
     case NAVDIR_LASTCHILD:
       if (delegate_->GetChildCount() > 0)
         result = delegate_->ChildAtIndex(delegate_->GetChildCount() - 1);
       break;
 
     case NAVDIR_NEXT: {
-      AXPlatformNodeBase* next = GetNextSibling();
+      AXPlatformNodeBase* next = target->GetNextSibling();
       if (next)
         result = next->GetNativeViewAccessible();
       break;
     }
 
     case NAVDIR_PREVIOUS: {
-      AXPlatformNodeBase* previous = GetPreviousSibling();
+      AXPlatformNodeBase* previous = target->GetPreviousSibling();
       if (previous)
         result = previous->GetNativeViewAccessible();
       break;
     }
-
-    default:
-      return E_INVALIDARG;
   }
 
-  if (!result) {
-    end->vt = VT_EMPTY;
+  if (!result)
     return S_FALSE;
-  }
 
   end->vt = VT_DISPATCH;
   end->pdispVal = result;
   // Always increment ref when returning a reference to a COM object.
   end->pdispVal->AddRef();
 
   return S_OK;
 }
 
 STDMETHODIMP AXPlatformNodeWin::get_accChild(VARIANT var_child,
@@ skipping 861 matching lines @@
   HandleSpecialTextOffset(&start_offset);
   ui::TextBoundaryType boundary = IA2TextBoundaryToTextBoundary(ia2_boundary);
   std::vector<int32_t> line_breaks;
   return static_cast<LONG>(ui::FindAccessibleTextBoundary(
       text, line_breaks, boundary, start_offset, direction,
       AX_TEXT_AFFINITY_DOWNSTREAM));
 }
 
 AXPlatformNodeWin* AXPlatformNodeWin::GetTargetFromChildID(
     const VARIANT& var_id) {
+  if (V_VT(&var_id) != VT_I4)
+    return nullptr;
+
   LONG child_id = V_I4(&var_id);
-  if (child_id == CHILDID_SELF) {
+  if (child_id == CHILDID_SELF)
     return this;
-  }
 
   if (child_id >= 1 && child_id <= delegate_->GetChildCount()) {
     // Positive child ids are a 1-based child index, used by clients
     // that want to enumerate all immediate children.
     AXPlatformNodeBase* base =
         FromNativeViewAccessible(delegate_->ChildAtIndex(child_id - 1));
     return static_cast<AXPlatformNodeWin*>(base);
   }
 
   if (child_id >= 0)
     return nullptr;
 
   // Negative child ids can be used to map to any descendant.
   AXPlatformNode* node = GetFromUniqueId(-child_id);
   if (!node)
     return nullptr;
 
   AXPlatformNodeBase* base =
       FromNativeViewAccessible(node->GetNativeViewAccessible());
   if (base && !IsDescendant(base))
     base = nullptr;
 
   return static_cast<AXPlatformNodeWin*>(base);
 }
 
 }  // namespace ui