Fix crash in hidden <select>

third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp

Index: third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp
diff --git a/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp b/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp
index af8b879f8aa95cb684c00df08472d6ac07eb7339..f8c4eec6adeeb596d381765f435ccf89232a9bae 100644
--- a/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp
+++ b/third_party/WebKit/Source/modules/accessibility/AXMenuListOption.cpp
@@ -28,6 +28,7 @@
 #include "SkMatrix44.h"
 #include "core/dom/AccessibleNode.h"
 #include "core/html/HTMLSelectElement.h"
+#include "modules/accessibility/AXMenuList.h"
 #include "modules/accessibility/AXMenuListPopup.h"
 #include "modules/accessibility/AXObjectCacheImpl.h"
 
@@ -48,6 +49,12 @@ void AXMenuListOption::Detach() {
   AXMockObject::Detach();
 }
 
+LocalFrameView* AXMenuListOption::DocumentFrameView() const {

[dmazzoni, 2017/05/31 00:01:15]

Could you implement GetDocument() instead (since DocumentFrameView just calls
Document first, and that would fix Document too)?

Could you move this up to AXMockObject so that it's fixed for any AXMockObject
that still has an associated node?

[aboxhall, 2017/05/31 00:20:08]

DocumentFrameView() in AXObjectImpl doesn't call GetDocument() - in fact the
reverse is true.
 
element_ is a member of AXMenuList. I don't think GetNode() would work, since
it's not an AXNodeObject.

+  if (IsDetached())
+    return nullptr;
+  return element_->GetDocument().View();
+}
+
 AccessibilityRole AXMenuListOption::RoleValue() const {
   const AtomicString& aria_role =
       GetAOMPropertyOrARIAAttribute(AOMStringProperty::kRole);
@@ -72,14 +79,21 @@ AXObjectImpl* AXMenuListOption::ComputeParent() const {
   if (!select)
     return nullptr;
   AXObjectImpl* select_ax_object = AxObjectCache().GetOrCreate(select);
-  if (select_ax_object->HasChildren()) {
-    const auto& child_objects = select_ax_object->Children();
-    DCHECK(!child_objects.IsEmpty());
+
+  // This happens if the <select> is not rendered. Return it and move on.
+  if (!select_ax_object->IsMenuList())
+    return select_ax_object;
+
+  AXMenuList* menu_list = ToAXMenuList(select_ax_object);
+  if (menu_list->HasChildren()) {
+    const auto& child_objects = menu_list->Children();
+    if (child_objects.IsEmpty())
+      return nullptr;
     DCHECK_EQ(child_objects.size(), 1UL);
     DCHECK(child_objects[0]->IsMenuListPopup());
     ToAXMenuListPopup(child_objects[0].Get())->UpdateChildrenIfNecessary();
   } else {
-    select_ax_object->UpdateChildrenIfNecessary();
+    menu_list->UpdateChildrenIfNecessary();
   }
   return parent_.Get();
 }