GitLab

The crash is due to the TextAttributeList never getting set in the
TextAttributeMap for the node when the node is an empty Role::kButton
from Blink.

BrowserAccessibility::IsLeaf was enforcing leafiness for Role::kButton
when there is exactly one child and that child is text. In all other
cases (including no children), IsLeaf was returning false for buttons.
As a result, BrowserAccessibility::ComputeTextAttributeMap was looking
to the non-existent children of empty buttons rather than using the
default attributes as it does for all other leaf nodes.

To fix the crash, and potentially other issues, check for childless
buttons in BrowserAccessibility::IsLeaf.

AX-Relnotes: Prevents browser crash which can result from an assistive
technology asking for the text attributes for an empty button.

Bug: 1107407
Change-Id: I985ba0dc5c6eb1b28bcfe9e6c1e18f44ba0fcfe1
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2310332Reviewed-by: Nektarios Paisios <nektar@chromium.org>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Commit-Queue: Nektarios Paisios <nektar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#792310}