Fix race in BrowserAccessibilityManagerWin creation.

content/browser/renderer_host/render_widget_host_view_aura.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/renderer_host/render_widget_host_view_aura.h"
 
 #include "base/auto_reset.h"
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/callback_helpers.h"
@@ skipping 1001 matching lines @@
   // NPNVnetscapeWindow property corresponds to the bounds of the webpage.
   // This is not true in Aura where we have only HWND which is the main Aura
   // window. If we return this window to plugins like Flash then it causes the
   // coordinate translations done by these plugins to break.
   // Additonally the legacy dummy window is needed for accessibility and for
   // scrolling to work in legacy drivers for trackpoints/trackpads, etc.
   if (GetNativeViewId()) {
     if (!legacy_render_widget_host_HWND_) {
       legacy_render_widget_host_HWND_ = LegacyRenderWidgetHostHWND::Create(
           reinterpret_cast<HWND>(GetNativeViewId()));
+      BrowserAccessibilityManager* manager = GetBrowserAccessibilityManager();
+      if (manager) {
+        legacy_render_widget_host_HWND_->set_browser_accessibility_manager(

[ananta, 2014/06/12 18:30:17]

This will crash in Windows 8 ASH. You may want to move this code below under the
if (legacy_render_widget_host_HWND_) block.

+            static_cast<BrowserAccessibilityManagerWin*>(manager));
+      }
     }
     if (legacy_render_widget_host_HWND_) {
       legacy_render_widget_host_HWND_->SetBounds(
           window_->GetBoundsInRootWindow());
     }
   }
 
   if (mouse_locked_)
     UpdateMouseLockRegion();
 #endif
@@ skipping 56 matching lines @@
   if (frame->software_frame_data) {
     DLOG(ERROR) << "Unable to use software frame in aura";
     RecordAction(
         base::UserMetricsAction("BadMessageTerminate_SharedMemoryAura"));
     host_->GetProcess()->ReceivedBadMessage();
     return;
   }
 }
 
 #if defined(OS_WIN)
-void RenderWidgetHostViewAura::SetParentNativeViewAccessible(
-    gfx::NativeViewAccessible accessible_parent) {
-  if (GetBrowserAccessibilityManager()) {
-    GetBrowserAccessibilityManager()->ToBrowserAccessibilityManagerWin()
-        ->set_parent_iaccessible(accessible_parent);
-  }
+HWND RenderWidgetHostViewAura::GetAccessibleParentHWND() const {
+  if (!legacy_render_widget_host_HWND_)
+    return NULL;
+  return legacy_render_widget_host_HWND_->hwnd();
+}
+
+IAccessible* RenderWidgetHostViewAura::GetParentIAccessible() const {
+  if (!legacy_render_widget_host_HWND_)
+    return NULL;
+  return legacy_render_widget_host_HWND_->window_accessible();
 }
 
 gfx::NativeViewId RenderWidgetHostViewAura::GetParentForWindowlessPlugin()
     const {
   if (legacy_render_widget_host_HWND_) {
     return reinterpret_cast<gfx::NativeViewId>(
         legacy_render_widget_host_HWND_->hwnd());
   }
   return NULL;
 }
@@ skipping 135 matching lines @@
              ? INPUT_EVENT_ACK_STATE_CONSUMED
              : INPUT_EVENT_ACK_STATE_NOT_CONSUMED;
 }
 
 void RenderWidgetHostViewAura::CreateBrowserAccessibilityManagerIfNeeded() {
   if (GetBrowserAccessibilityManager())
     return;
 
   BrowserAccessibilityManager* manager = NULL;
 #if defined(OS_WIN)
-  aura::WindowTreeHost* host = window_->GetHost();
-  if (!host)
-    return;
-  HWND hwnd = host->GetAcceleratedWidget();
-
-  // The accessible_parent may be NULL at this point. The WebContents will pass
-  // it down to this instance (by way of the RenderViewHost and
-  // RenderWidgetHost) when it is known. This instance will then set it on its
-  // BrowserAccessibilityManager.
-  gfx::NativeViewAccessible accessible_parent =
-      host_->GetParentNativeViewAccessible();
-
+  manager = new BrowserAccessibilityManagerWin(
+      BrowserAccessibilityManagerWin::GetEmptyDocument(), host_);
   if (legacy_render_widget_host_HWND_) {
-    manager = new BrowserAccessibilityManagerWin(
-        legacy_render_widget_host_HWND_.get(), accessible_parent,
-        BrowserAccessibilityManagerWin::GetEmptyDocument(), host_);
+    legacy_render_widget_host_HWND_->set_browser_accessibility_manager(
+        static_cast<BrowserAccessibilityManagerWin*>(manager));
   }
 #else
   manager = BrowserAccessibilityManager::Create(
       BrowserAccessibilityManager::GetEmptyDocument(), host_);
 #endif
   SetBrowserAccessibilityManager(manager);
 }
 
 gfx::GLSurfaceHandle RenderWidgetHostViewAura::GetCompositingSurface() {
   return ImageTransportFactory::GetInstance()->GetSharedSurfaceHandle();
@@ skipping 899 matching lines @@
   event_filter_for_popup_exit_.reset();
   aura::client::SetTooltipText(window_, NULL);
   gfx::Screen::GetScreenFor(window_)->RemoveObserver(this);
 
   // This call is usually no-op since |this| object is already removed from the
   // Aura root window and we don't have a way to get an input method object
   // associated with the window, but just in case.
   DetachFromInputMethod();
 
 #if defined(OS_WIN)
+  if (legacy_render_widget_host_HWND_.get())
+    legacy_render_widget_host_HWND_->OnManagerDeleted();
   legacy_render_widget_host_HWND_.reset(NULL);
 #endif
 }
 
 void RenderWidgetHostViewAura::UpdateCursorIfOverSelf() {
   const gfx::Point screen_point =
       gfx::Screen::GetScreenFor(GetNativeView())->GetCursorScreenPoint();
   aura::Window* root_window = window_->GetRootWindow();
   if (!root_window)
     return;
@@ skipping 257 matching lines @@
 
 ////////////////////////////////////////////////////////////////////////////////
 // RenderWidgetHostViewBase, public:
 
 // static
 void RenderWidgetHostViewBase::GetDefaultScreenInfo(WebScreenInfo* results) {
   GetScreenInfoForWindow(results, NULL);
 }
 
 }  // namespace content