GitLab

In some cases, we can give a new AXTreeID to an existing AXTree,
replacing the key associated to the tree's AXTreeManager in the
AXTreeManagerMap for the new tree id. This happens on a page reload or
on same-page navigation.

We store a AXPlatformNodeTextRangeProviderWin::TextRangeEndpoints -
which is an AXTreeObserver on the AXTree. When such a scenario happens,
the AXPlatformNodeTextRangeProviderWin loses its access to the access
because its nodes are not referencing the new tree id. we then start our
destruction process and try to remove the observer from the tree's
obersers list - without success, because we can't get the AXTreeManager
from the previous tree id. This causes us to keep a reference to a
destroyed object in the observers list.

To avoid this issue, the AXTreeManagerMap is now notifying the observers
about its removal right before it happens. This allows us to remove the
observer before if needed.

Bug: N/A
AX-Relnotes: Fix crash occurring on page reload with UIA enabled.
Change-Id: I6fe6b35764e3c7c3e7391733217b84bb43201a58
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2596013
Commit-Queue: Benjamin Beaudry <benjamin.beaudry@microsoft.com>
Reviewed-by: Kurt Catti-Schmidt <kschmi@microsoft.com>
Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#838192}