GitLab

AXPosition::AtEndOfTextSpan relies on CreateParentPosition to
determine if an inline text box marks the end of text span. Since
CreateParentPosition calls into AtStartOfLine which calls
AtEndOfTextSpan so we end up with an infinite loop and stack overflow.

https://crrev.com/c/2245611 fixed most cases with this infinite loop
of AtStartOfLine/CreateParentPosition/AtEndOfTextSpan by checking for
AtEndOfAnchor first before calling AtEndOfTextSpan.

However consider the following example:
<style>
  .required-label::after {
    content: " *";
  }
</style>
<label class="required-label">Required </label>

labelText #1
++staticText name='Required ' nextOnLineId=inlineTextBox  #2
++++inlineTextBox name='Required ' nextOnLineId=inlineTextBox #3
++staticText name=' *' previousOnLineId=inlineTextBox #4
++++inlineTextBox name='*' previousOnLineId=inlineTextBox #5

AtEndOfAnchor check would not prevent this infinite loop, if
AtStartOfLine is called on staticText #4 name=' *' as the max text
offsets differ between staticText #4 and its inlineText #5.

This CL fixes the above issue by making AtEndOfTextSpan not to call
CreateParentPosition. Instead it determines end of text span by
directly looking at the current position's parent role and its index
among its siblings.

AX-Relnotes: Fixes hangs in certain accessibility scenarios.

Bug: 1120636
Change-Id: Ic99c27b069f220f26da736b3946560ef23d6b622
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2369681
Commit-Queue: Victor Fei <vicfei@microsoft.com>
Reviewed-by: Nektarios Paisios <nektar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#804531}