All a11y methods in RenderFrameHost should check if the host is active before proceeding

When a RenderFrameHost is being swapped out, it will be in the process of being deleted.
Before any requests from accessibility should be serviced, we should
check if the RenderFrameHost is not being swapped out.
Otherwise, parts of the class instance, such as its RenderViewHost,
might have been destroyed, or the renderer associated with
the RenderFrameHost instance might not be able to
receive IPCs.

R=dmazzoni@chromium.org

Change-Id: I08a87cad7b789f0752adbcc1564b748456d5d338
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1881324Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Reviewed-by: Avi Drissman <avi@chromium.org>
Commit-Queue: Nektarios Paisios <nektar@chromium.org>
Cr-Commit-Position: refs/heads/master@{#709917}

content/browser/frame_host/render_frame_host_impl.cc

@@ -1694,10 +1694,15 @@ void RenderFrameHostImpl::OnAssociatedInterfaceRequest(
 
 void RenderFrameHostImpl::AccessibilityPerformAction(
     const ui::AXActionData& action_data) {
+  if (!is_active())
+    return;
   Send(new AccessibilityMsg_PerformAction(routing_id_, action_data));
 }
 
 bool RenderFrameHostImpl::AccessibilityViewHasFocus() const {
+  if (!is_active())
+    return false;
+
   RenderWidgetHostView* view = render_view_host_->GetWidget()->GetView();
   if (view)
     return view->HasFocus();
@@ -1705,12 +1710,18 @@ bool RenderFrameHostImpl::AccessibilityViewHasFocus() const {
 }
 
 void RenderFrameHostImpl::AccessibilityViewSetFocus() {
+  if (!is_active())
+    return;
+
   RenderWidgetHostView* view = render_view_host_->GetWidget()->GetView();
   if (view)
     view->Focus();
 }
 
 gfx::Rect RenderFrameHostImpl::AccessibilityGetViewBounds() const {
+  if (!is_active())
+    return gfx::Rect();
+
   RenderWidgetHostView* view = render_view_host_->GetWidget()->GetView();
   if (view)
     return view->GetViewBounds();
@@ -1718,6 +1729,9 @@ gfx::Rect RenderFrameHostImpl::AccessibilityGetViewBounds() const {
 }
 
 float RenderFrameHostImpl::AccessibilityGetDeviceScaleFactor() const {
+  if (!is_active())
+    return 1.0f;
+
   RenderWidgetHostView* view = render_view_host_->GetWidget()->GetView();
   if (view)
     return GetScaleFactorForView(view);
@@ -1748,7 +1762,7 @@ RenderFrameHostImpl::AccessibilityGetAcceleratedWidget() {
   // Only the main frame's current frame host is connected to the native
   // widget tree for accessibility, so return null if this is queried on
   // any other frame.
-  if (frame_tree_node()->parent() || !IsCurrent())
+  if (!is_active() || frame_tree_node()->parent() || !IsCurrent())
     return gfx::kNullAcceleratedWidget;
 
   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
@@ -1760,6 +1774,9 @@ RenderFrameHostImpl::AccessibilityGetAcceleratedWidget() {
 
 gfx::NativeViewAccessible
 RenderFrameHostImpl::AccessibilityGetNativeViewAccessible() {
+  if (!is_active())
+    return nullptr;
+
   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
       render_view_host_->GetWidget()->GetView());
   if (view)
@@ -1769,6 +1786,9 @@ RenderFrameHostImpl::AccessibilityGetNativeViewAccessible() {
 
 gfx::NativeViewAccessible
 RenderFrameHostImpl::AccessibilityGetNativeViewAccessibleForWindow() {
+  if (!is_active())
+    return nullptr;
+
   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
       render_view_host_->GetWidget()->GetView());
   if (view)
@@ -1777,10 +1797,14 @@ RenderFrameHostImpl::AccessibilityGetNativeViewAccessibleForWindow() {
 }
 
 WebContents* RenderFrameHostImpl::AccessibilityWebContents() {
+  if (!is_active())
+    return nullptr;
   return delegate()->GetAsWebContents();
 }
 
 bool RenderFrameHostImpl::AccessibilityIsMainFrame() const {
+  if (!is_active())
+    return false;
   return frame_tree_node()->IsMainFrame();
 }
 
@@ -3763,12 +3787,12 @@ void RenderFrameHostImpl::EvictFromBackForwardCacheWithReason(
 
 void RenderFrameHostImpl::OnAccessibilityLocationChanges(
     const std::vector<AccessibilityHostMsg_LocationChangeParams>& params) {
-  if (accessibility_reset_token_)
+  if (accessibility_reset_token_ || !is_active())
     return;
 
   RenderWidgetHostViewBase* view = static_cast<RenderWidgetHostViewBase*>(
       render_view_host_->GetWidget()->GetView());
-  if (view && is_active()) {
+  if (view) {
     ui::AXMode accessibility_mode = delegate_->GetAccessibilityMode();
     if (accessibility_mode.has_mode(ui::AXMode::kNativeAPIs)) {
       BrowserAccessibilityManager* manager =
@@ -3795,7 +3819,7 @@ void RenderFrameHostImpl::OnAccessibilityLocationChanges(
 void RenderFrameHostImpl::OnAccessibilityFindInPageResult(
     const AccessibilityHostMsg_FindInPageResultParams& params) {
   ui::AXMode accessibility_mode = delegate_->GetAccessibilityMode();
-  if (accessibility_mode.has_mode(ui::AXMode::kNativeAPIs)) {
+  if (accessibility_mode.has_mode(ui::AXMode::kNativeAPIs) && is_active()) {
     BrowserAccessibilityManager* manager =
         GetOrCreateBrowserAccessibilityManager();
     if (manager) {
@@ -3808,7 +3832,7 @@ void RenderFrameHostImpl::OnAccessibilityFindInPageResult(
 
 void RenderFrameHostImpl::OnAccessibilityFindInPageTermination() {
   ui::AXMode accessibility_mode = delegate_->GetAccessibilityMode();
-  if (accessibility_mode.has_mode(ui::AXMode::kNativeAPIs)) {
+  if (accessibility_mode.has_mode(ui::AXMode::kNativeAPIs) && is_active()) {
     BrowserAccessibilityManager* manager =
         GetOrCreateBrowserAccessibilityManager();
     if (manager)
@@ -3837,7 +3861,7 @@ void RenderFrameHostImpl::OnAccessibilityChildFrameHitTestResult(
     NOTREACHED();
   }
 
-  if (!child_frame)
+  if (!child_frame || !child_frame->is_active())
     return;
 
   ui::AXActionData action_data;

content/browser/frame_host/render_frame_host_impl.h

@@ -607,7 +607,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // until it is pending deletion. Pending deletion starts when SwapOut is
   // called on the frame or one of its ancestors.
   // BackForwardCache: Returns false when the frame is in the BackForwardCache.
-  bool is_active() {
+  bool is_active() const {
     return unload_state_ == UnloadState::NotRun && !is_in_back_forward_cache_;
   }
 
@@ -968,7 +968,7 @@ class CONTENT_EXPORT RenderFrameHostImpl
   // BackForwardCache after time to live.
   void StartBackForwardCacheEvictionTimer();
 
-  bool is_in_back_forward_cache() { return is_in_back_forward_cache_; }
+  bool is_in_back_forward_cache() const { return is_in_back_forward_cache_; }
 
   bool is_back_forward_cache_disabled() const {
     return is_back_forward_cache_disabled_;