Fix crash in hidden <select>

third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp

 /*
  * Copyright (C) 2010 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 10 matching lines @@
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "modules/accessibility/AXMenuListOption.h"
 
 #include "SkMatrix44.h"
 #include "core/dom/AccessibleNode.h"
 #include "core/html/HTMLSelectElement.h"
+#include "modules/accessibility/AXMenuList.h"
 #include "modules/accessibility/AXMenuListPopup.h"
 #include "modules/accessibility/AXObjectCacheImpl.h"
 
 namespace blink {
 
 using namespace HTMLNames;
 
 AXMenuListOption::AXMenuListOption(HTMLOptionElement* element,
                                    AXObjectCacheImpl& ax_object_cache)
     : AXMockObject(ax_object_cache), element_(element) {}
 
 AXMenuListOption::~AXMenuListOption() {
   DCHECK(!element_);
 }
 
 void AXMenuListOption::Detach() {
   element_ = nullptr;
   AXMockObject::Detach();
 }
 
+LocalFrameView* AXMenuListOption::DocumentFrameView() const {

[dmazzoni, 2017/05/31 00:01:15]

Could you implement GetDocument() instead (since DocumentFrameView just calls
Document first, and that would fix Document too)?

Could you move this up to AXMockObject so that it's fixed for any AXMockObject
that still has an associated node?

[aboxhall, 2017/05/31 00:20:08]

DocumentFrameView() in AXObjectImpl doesn't call GetDocument() - in fact the
reverse is true.
 
element_ is a member of AXMenuList. I don't think GetNode() would work, since
it's not an AXNodeObject.

+  if (IsDetached())
+    return nullptr;
+  return element_->GetDocument().View();
+}
+
 AccessibilityRole AXMenuListOption::RoleValue() const {
   const AtomicString& aria_role =
       GetAOMPropertyOrARIAAttribute(AOMStringProperty::kRole);
   if (aria_role.IsEmpty())
     return kMenuListOptionRole;
 
   AccessibilityRole role = AriaRoleToWebCoreRole(aria_role);
   if (role)
     return role;
   return kMenuListOptionRole;
 }
 
 Element* AXMenuListOption::ActionElement() const {
   return element_;
 }
 
 AXObjectImpl* AXMenuListOption::ComputeParent() const {
   Node* node = GetNode();
   if (!node)
     return nullptr;
   HTMLSelectElement* select = toHTMLOptionElement(node)->OwnerSelectElement();
   if (!select)
     return nullptr;
   AXObjectImpl* select_ax_object = AxObjectCache().GetOrCreate(select);
-  if (select_ax_object->HasChildren()) {
-    const auto& child_objects = select_ax_object->Children();
-    DCHECK(!child_objects.IsEmpty());
+
+  // This happens if the <select> is not rendered. Return it and move on.
+  if (!select_ax_object->IsMenuList())
+    return select_ax_object;
+
+  AXMenuList* menu_list = ToAXMenuList(select_ax_object);
+  if (menu_list->HasChildren()) {
+    const auto& child_objects = menu_list->Children();
+    if (child_objects.IsEmpty())
+      return nullptr;
     DCHECK_EQ(child_objects.size(), 1UL);
     DCHECK(child_objects[0]->IsMenuListPopup());
     ToAXMenuListPopup(child_objects[0].Get())->UpdateChildrenIfNecessary();
   } else {
-    select_ax_object->UpdateChildrenIfNecessary();
+    menu_list->UpdateChildrenIfNecessary();
   }
   return parent_.Get();
 }
 
 bool AXMenuListOption::IsEnabled() const {
   // isDisabledFormControl() returns true if the parent <select> element is
   // disabled, which we don't want.
   return element_ && !element_->OwnElementDisabled();
 }
 
@@ skipping 111 matching lines @@
 
   return 0;
 }
 
 DEFINE_TRACE(AXMenuListOption) {
   visitor->Trace(element_);
   AXMockObject::Trace(visitor);
 }
 
 }  // namespace blink