GitLab

This change is a follow-up to
https://chromium-review.googlesource.com/c/chromium/src/+/2340291.

After that change went in, we are still seeing crashes in
BrowserAccessibility::AccessibilityPerformAction where the anchor
and/or focus nodes are not found, stemming from setSelectionRanges.

Based on code inspection, I was able to come up with this variation,
where the anchor and focus nodes are in the same tree as each other,
but in a different tree than the caller.

The crash dumps I have available not have enough data to prove that
this is the root cause of those specific crashes, but the unit test
added here is sufficient to show that this crash is possible.

Rather than returning an error in this scenario, when the anchor and
focus nodes are in in the same tree as each other, but a different
tree than the node calling setSelectionRanges, the tree that the anchor
and focus nodes reside in is used for looking up the manager and setting
the selection.

AX-Relnotes: n/a

Bug: 1110522
Change-Id: I28cb18e87bcd0cfa2abd3220878d4b04ac70f96a
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2504630
Commit-Queue: Kurt Catti-Schmidt <kschmi@microsoft.com>
Reviewed-by: Nektarios Paisios <nektar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#829866}