Fix crash in hidden <select>

third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp

 /*
  * Copyright (C) 2010 Apple Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
  *    notice, this list of conditions and the following disclaimer in the
@@ skipping 10 matching lines @@
  * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "modules/accessibility/AXMenuListOption.h"
 
 #include "SkMatrix44.h"
 #include "core/dom/AccessibleNode.h"
 #include "core/html/HTMLSelectElement.h"
+#include "modules/accessibility/AXMenuList.h"
 #include "modules/accessibility/AXMenuListPopup.h"
 #include "modules/accessibility/AXObjectCacheImpl.h"
 
 namespace blink {
 
 using namespace HTMLNames;
 
 AXMenuListOption::AXMenuListOption(HTMLOptionElement* element,
                                    AXObjectCacheImpl& ax_object_cache)
     : AXMockObject(ax_object_cache), element_(element) {}
 
 AXMenuListOption::~AXMenuListOption() {
   DCHECK(!element_);
 }
 
 void AXMenuListOption::Detach() {
   element_ = nullptr;
   AXMockObject::Detach();
 }
 
+LocalFrameView* AXMenuListOption::DocumentFrameView() const {
+  if (IsDetached())
+    return nullptr;
+  return element_->GetDocument().View();
+}
+
 AccessibilityRole AXMenuListOption::RoleValue() const {
   const AtomicString& aria_role =
       GetAOMPropertyOrARIAAttribute(AOMStringProperty::kRole);
   if (aria_role.IsEmpty())
     return kMenuListOptionRole;
 
   AccessibilityRole role = AriaRoleToWebCoreRole(aria_role);
   if (role)
     return role;
   return kMenuListOptionRole;
 }
 
 Element* AXMenuListOption::ActionElement() const {
   return element_;
 }
 
 AXObjectImpl* AXMenuListOption::ComputeParent() const {
   Node* node = GetNode();
   if (!node)
     return nullptr;
   HTMLSelectElement* select = toHTMLOptionElement(node)->OwnerSelectElement();
   if (!select)
     return nullptr;
   AXObjectImpl* select_ax_object = AxObjectCache().GetOrCreate(select);
-  if (select_ax_object->HasChildren()) {
-    const auto& child_objects = select_ax_object->Children();
-    DCHECK(!child_objects.IsEmpty());
+
+  // This happens if the <select> is not rendered. Return it and move on.
+  if (!select_ax_object->IsMenuList())
+    return select_ax_object;
+
+  AXMenuList* menu_list = ToAXMenuList(select_ax_object);
+  if (menu_list->HasChildren()) {
+    const auto& child_objects = menu_list->Children();
+    if (child_objects.IsEmpty())
+      return nullptr;
     DCHECK_EQ(child_objects.size(), 1UL);
     DCHECK(child_objects[0]->IsMenuListPopup());
     ToAXMenuListPopup(child_objects[0].Get())->UpdateChildrenIfNecessary();
   } else {
-    select_ax_object->UpdateChildrenIfNecessary();
+    menu_list->UpdateChildrenIfNecessary();
   }
   return parent_.Get();
 }
 
 bool AXMenuListOption::IsEnabled() const {
   // isDisabledFormControl() returns true if the parent <select> element is
   // disabled, which we don't want.
   return element_ && !element_->OwnElementDisabled();
 }
 
@@ skipping 111 matching lines @@
 
   return 0;
 }
 
 DEFINE_TRACE(AXMenuListOption) {
   visitor->Trace(element_);
   AXMockObject::Trace(visitor);
 }
 
 }  // namespace blink