Implement automatic load of composed/embedded automation trees

Introduces the metadata required to link together the desktop tree and a views::WebView. Additionally, implements the js side logic to resolve these links.

A views::WebView now gets assigned an AXRole of webView and its immediate child resolves to the rootWebArea it hosts. This resolution is done dynamically at runtime using the underlying AX tree id which itself is mapped using AXTreeIDRegistry back in the browser. If the hosting webView has yet to load its child rootWebArea, enableFrame will be called to and a callback waiting for the subroot's data; this auto load occurs as soon as a webView is seen during a tree update and results in a childrenChanged event once its child rootWebArea is available. When a caller asks for the parent of a rootWebArea, a dynamic lookup is also performed to retrieve a hosting webView, if any.

Review URL: https://codereview.chromium.org/667713006

Cr-Commit-Position: refs/heads/master@{#302648}

chrome/browser/accessibility/ax_tree_id_registry.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/accessibility/ax_tree_id_registry.h"
+
+#include "base/memory/singleton.h"
+
+// static
+AXTreeIDRegistry* AXTreeIDRegistry::GetInstance() {
+  return Singleton<AXTreeIDRegistry>::get();
+}
+
+int AXTreeIDRegistry::GetOrCreateAXTreeID(int process_id, int routing_id) {
+  FrameID frame_id(process_id, routing_id);
+  std::map<FrameID, AXTreeID>::iterator it;
+  it = frame_to_ax_tree_id_map_.find(frame_id);
+  if (it != frame_to_ax_tree_id_map_.end())
+    return it->second;
+
+  int new_id = ++ax_tree_id_counter_;
+  frame_to_ax_tree_id_map_[frame_id] = new_id;
+  ax_tree_to_frame_id_map_[new_id] = frame_id;
+
+  return new_id;
+}
+
+AXTreeIDRegistry::FrameID AXTreeIDRegistry::GetFrameID(int ax_tree_id) {
+  std::map<AXTreeID, FrameID>::iterator it;
+  it = ax_tree_to_frame_id_map_.find(ax_tree_id);
+  if (it != ax_tree_to_frame_id_map_.end())
+    return it->second;
+
+  return FrameID(-1, -1);
+}
+
+void AXTreeIDRegistry::RemoveAXTreeID(int ax_tree_id) {
+  std::map<AXTreeID, FrameID>::iterator it;
+  it = ax_tree_to_frame_id_map_.find(ax_tree_id);
+  if (it != ax_tree_to_frame_id_map_.end()) {
+    frame_to_ax_tree_id_map_.erase(it->second);
+    ax_tree_to_frame_id_map_.erase(it);
+  }
+}
+
+AXTreeIDRegistry::AXTreeIDRegistry() : ax_tree_id_counter_(-1) {
+  // Always populate default desktop tree value (0 -> 0, 0).
+  GetOrCreateAXTreeID(0, 0);
+}
+
+AXTreeIDRegistry::~AXTreeIDRegistry() {
+}

chrome/browser/accessibility/ax_tree_id_registry.h

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CHROME_BROWSER_ACCESSIBILITY_AX_TREE_ID_REGISTRY_H_
+#define CHROME_BROWSER_ACCESSIBILITY_AX_TREE_ID_REGISTRY_H_
+
+#include <map>
+
+#include "base/stl_util.h"
+
+template <typename T>
+struct DefaultSingletonTraits;
+
+// A class which generates a unique id given a process id and routing id.
+// Currently, placeholder implementation pending finalization of out of process
+// iframes.
+class AXTreeIDRegistry {
+ public:
+  typedef int AXTreeID;
+  typedef std::pair<int, int> FrameID;
+
+  // Get the single instance of this class.
+  static AXTreeIDRegistry* GetInstance();
+
+  // Obtains a unique id given a |process_id| and |routing_id|. Placeholder
+  // for full implementation once out of process iframe accessibility finalizes.
+  int GetOrCreateAXTreeID(int process_id, int routing_id);
+  FrameID GetFrameID(int ax_tree_id);
+  void RemoveAXTreeID(int ax_tree_id);
+
+ private:
+  friend struct DefaultSingletonTraits<AXTreeIDRegistry>;
+
+  AXTreeIDRegistry();
+  virtual ~AXTreeIDRegistry();
+
+  // Tracks the current unique ax frame id.
+  int ax_tree_id_counter_;
+
+  // Maps an accessibility tree to its frame via ids.
+  std::map<AXTreeID, FrameID> ax_tree_to_frame_id_map_;
+
+  // Maps frames to an accessibility tree via ids.
+  std::map<FrameID, AXTreeID> frame_to_ax_tree_id_map_;
+
+  DISALLOW_COPY_AND_ASSIGN(AXTreeIDRegistry);
+};
+
+#endif  // CHROME_BROWSER_ACCESSIBILITY_AX_TREE_ID_REGISTRY_H_

chrome/browser/extensions/api/automation/automation_apitest.cc

@@ -159,6 +159,11 @@ IN_PROC_BROWSER_TEST_F(AutomationApiTest, DesktopActions) {
   ASSERT_TRUE(RunExtensionSubtest("automation/tests/desktop", "actions.html"))
       << message_;
 }
+
+IN_PROC_BROWSER_TEST_F(AutomationApiTest, DesktopLoadTabs) {
+  ASSERT_TRUE(RunExtensionSubtest("automation/tests/desktop", "load_tabs.html"))
+      << message_;
+}
 #else
 IN_PROC_BROWSER_TEST_F(AutomationApiTest, DesktopNotSupported) {
   ASSERT_TRUE(RunExtensionSubtest("automation/tests/desktop",
@@ -336,9 +341,9 @@ class FakeAutomationInternalEnableTabFunction
           base::Bind(&TreeSerializationState::InitializeTree0,
                      base::Unretained(&state),
                      base::Unretained(browser_context())));
-      return RespondNow(
-          ArgumentList(api::automation_internal::EnableTab::Results::Create(
-              kPid, kTab0Rid)));
+      // TODO(aboxhall): Need to rewrite this test in terms of tree ids.
+      return RespondNow(ArgumentList(
+          api::automation_internal::EnableTab::Results::Create(0)));
     }
     if (tab_id == 1) {
       // tab 1 <--> tree1
@@ -347,9 +352,8 @@ class FakeAutomationInternalEnableTabFunction
           base::Bind(&TreeSerializationState::InitializeTree1,
                      base::Unretained(&state),
                      base::Unretained(browser_context())));
-      return RespondNow(
-          ArgumentList(api::automation_internal::EnableTab::Results::Create(
-              kPid, kTab1Rid)));
+      return RespondNow(ArgumentList(
+          api::automation_internal::EnableTab::Results::Create(0)));
     }
     return RespondNow(Error("Unrecognised tab_id"));
   }

chrome/browser/extensions/api/automation_internal/automation_internal_api.cc

@@ -7,6 +7,7 @@
 #include <vector>
 
 #include "base/strings/string_number_conversions.h"
+#include "chrome/browser/accessibility/ax_tree_id_registry.h"
 #include "chrome/browser/extensions/api/automation_internal/automation_action_adapter.h"
 #include "chrome/browser/extensions/api/automation_internal/automation_util.h"
 #include "chrome/browser/extensions/api/tabs/tabs_constants.h"
@@ -17,6 +18,7 @@
 #include "chrome/common/extensions/api/automation_internal.h"
 #include "chrome/common/extensions/manifest_handlers/automation.h"
 #include "content/public/browser/ax_event_notification_details.h"
+#include "content/public/browser/browser_accessibility_state.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_widget_host.h"
@@ -35,9 +37,7 @@ class AutomationWebContentsObserver;
 DEFINE_WEB_CONTENTS_USER_DATA_KEY(extensions::AutomationWebContentsObserver);
 
 namespace {
-const int kDesktopProcessID = 0;
-const int kDesktopRoutingID = 0;
-
+const int kDesktopTreeID = 0;
 const char kCannotRequestAutomationOnPage[] =
     "Cannot request automation tree on url \"*\". "
     "Extension manifest must request permission to access this host.";
@@ -164,10 +164,35 @@ AutomationInternalEnableTabFunction::Run() {
   }
   AutomationWebContentsObserver::CreateForWebContents(contents);
   contents->EnableTreeOnlyAccessibilityMode();
-  return RespondNow(
-      ArgumentList(api::automation_internal::EnableTab::Results::Create(
-          rfh->GetProcess()->GetID(), rfh->GetRoutingID())));
-  }
+  int ax_tree_id = AXTreeIDRegistry::GetInstance()->GetOrCreateAXTreeID(
+      rfh->GetProcess()->GetID(), rfh->GetRoutingID());
+  return RespondNow(ArgumentList(
+      api::automation_internal::EnableTab::Results::Create(ax_tree_id)));
+}
+
+ExtensionFunction::ResponseAction AutomationInternalEnableFrameFunction::Run() {
+// TODO(dtseng): Limited to desktop tree for now pending out of proc iframes.
+#if defined(OS_CHROMEOS)
+  using api::automation_internal::EnableFrame::Params;
+
+  scoped_ptr<Params> params(Params::Create(*args_));
+  EXTENSION_FUNCTION_VALIDATE(params.get());
+  AXTreeIDRegistry::FrameID frame_id =
+      AXTreeIDRegistry::GetInstance()->GetFrameID(params->tree_id);
+  content::RenderFrameHost* rfh =
+      content::RenderFrameHost::FromID(frame_id.first, frame_id.second);
+  if (!rfh)
+    return RespondNow(Error("unable to load tab"));
+
+  content::WebContents* contents =
+      content::WebContents::FromRenderFrameHost(rfh);
+  AutomationWebContentsObserver::CreateForWebContents(contents);
+  contents->EnableTreeOnlyAccessibilityMode();
+
+  return RespondNow(NoArguments());
+#endif
+  return RespondNow(Error("enableFrame is only supported on Chrome OS"));
+}
 
 ExtensionFunction::ResponseAction
 AutomationInternalPerformActionFunction::Run() {
@@ -178,8 +203,7 @@ AutomationInternalPerformActionFunction::Run() {
   scoped_ptr<Params> params(Params::Create(*args_));
   EXTENSION_FUNCTION_VALIDATE(params.get());
 
-  if (params->args.process_id == kDesktopProcessID &&
-      params->args.routing_id == kDesktopRoutingID) {
+  if (params->args.tree_id == kDesktopTreeID) {
 #if defined(OS_CHROMEOS)
     return RouteActionToAdapter(
         params.get(), AutomationManagerAsh::GetInstance());
@@ -189,9 +213,10 @@ AutomationInternalPerformActionFunction::Run() {
                             " platform does not support desktop automation"));
 #endif  // defined(OS_CHROMEOS)
   }
+  AXTreeIDRegistry::FrameID frame_id =
+      AXTreeIDRegistry::GetInstance()->GetFrameID(params->args.tree_id);
   content::RenderFrameHost* rfh =
-      content::RenderFrameHost::FromID(params->args.process_id,
-                                       params->args.routing_id);
+      content::RenderFrameHost::FromID(frame_id.first, frame_id.second);
   if (!rfh)
     return RespondNow(Error("Ignoring action on destroyed node"));
 

chrome/browser/extensions/api/automation_internal/automation_internal_api.h

@@ -58,6 +58,15 @@ class AutomationInternalPerformActionFunction
       AutomationActionAdapter* adapter);
 };
 
+class AutomationInternalEnableFrameFunction : public UIThreadExtensionFunction {
+  DECLARE_EXTENSION_FUNCTION("automationInternal.enableFrame",
+                             AUTOMATIONINTERNAL_PERFORMACTION)
+ protected:
+  ~AutomationInternalEnableFrameFunction() override {}
+
+  ExtensionFunction::ResponseAction Run() override;
+};
+
 class AutomationInternalEnableDesktopFunction
     : public UIThreadExtensionFunction {
   DECLARE_EXTENSION_FUNCTION("automationInternal.enableDesktop",

chrome/browser/extensions/api/automation_internal/automation_util.cc

@@ -8,6 +8,7 @@
 #include <utility>
 
 #include "base/values.h"
+#include "chrome/browser/accessibility/ax_tree_id_registry.h"
 #include "chrome/common/extensions/api/automation_internal.h"
 #include "extensions/browser/event_router.h"
 #include "ui/accessibility/ax_enums.h"
@@ -136,8 +137,9 @@ void DispatchAccessibilityEventsToAutomation(
     const content::AXEventNotificationDetails& event = *iter;
 
     AXEventParams ax_event_params;
-    ax_event_params.process_id = event.process_id;
-    ax_event_params.routing_id = event.routing_id;
+    ax_event_params.tree_id =
+        AXTreeIDRegistry::GetInstance()->GetOrCreateAXTreeID(event.process_id,
+                                                             event.routing_id);
     ax_event_params.event_type = ToString(iter->event_type);
     ax_event_params.target_id = event.id;
 
@@ -168,11 +170,13 @@ void DispatchTreeDestroyedEventToAutomation(
     int process_id,
     int routing_id,
     content::BrowserContext* browser_context) {
+  int tree_id = AXTreeIDRegistry::GetInstance()->GetOrCreateAXTreeID(
+      process_id, routing_id);
   DispatchEventInternal(
       browser_context,
       api::automation_internal::OnAccessibilityTreeDestroyed::kEventName,
-      api::automation_internal::OnAccessibilityTreeDestroyed::Create(
-          process_id, routing_id));
+      api::automation_internal::OnAccessibilityTreeDestroyed::Create(tree_id));
+  AXTreeIDRegistry::GetInstance()->RemoveAXTreeID(tree_id);
 }
 
 }  // namespace automation_util

chrome/browser/ui/ash/accessibility/automation_manager_ash.cc

@@ -44,8 +44,6 @@ void AutomationManagerAsh::HandleEvent(BrowserContext* context,
     return;
   }
 
-  // TODO(dtseng): Events should only be delivered to extensions with the
-  // desktop permission.
   views::Widget* widget = view->GetWidget();
   if (!widget)
     return;
@@ -83,7 +81,8 @@ void AutomationManagerAsh::SetSelection(int32 id, int32 start, int32 end) {
   current_tree_->SetSelection(id, start, end);
 }
 
-AutomationManagerAsh::AutomationManagerAsh() : enabled_(false) {}
+AutomationManagerAsh::AutomationManagerAsh() : enabled_(false) {
+}
 
 AutomationManagerAsh::~AutomationManagerAsh() {}
 

chrome/browser/ui/ash/accessibility/automation_manager_ash.h

@@ -7,7 +7,6 @@
 
 #include "base/basictypes.h"
 #include "base/memory/scoped_ptr.h"
-
 #include "chrome/browser/extensions/api/automation_internal/automation_action_adapter.h"
 #include "chrome/browser/ui/ash/accessibility/ax_tree_source_ash.h"
 #include "ui/accessibility/ax_tree_serializer.h"

chrome/browser/ui/ash/accessibility/ax_tree_source_ash.cc

@@ -6,8 +6,15 @@
 
 #include <vector>
 
+#include "chrome/browser/accessibility/ax_tree_id_registry.h"
+#include "chrome/browser/ui/ash/accessibility/automation_manager_ash.h"
+#include "content/public/browser/render_frame_host.h"
+#include "content/public/browser/render_process_host.h"
+#include "content/public/browser/web_contents.h"
 #include "ui/views/accessibility/ax_aura_obj_cache.h"
 #include "ui/views/accessibility/ax_aura_obj_wrapper.h"
+#include "ui/views/accessibility/ax_view_obj_wrapper.h"
+#include "ui/views/controls/webview/webview.h"
 
 using views::AXAuraObjCache;
 using views::AXAuraObjWrapper;
@@ -90,6 +97,20 @@ AXAuraObjWrapper* AXTreeSourceAsh::GetNull() const {
 void AXTreeSourceAsh::SerializeNode(
     AXAuraObjWrapper* node, ui::AXNodeData* out_data) const {
   node->Serialize(out_data);
+
+  if (out_data->role == ui::AX_ROLE_WEB_VIEW) {
+    views::View* view = static_cast<views::AXViewObjWrapper*>(node)->view();
+    content::WebContents* contents =
+        static_cast<views::WebView*>(view)->GetWebContents();
+    content::RenderFrameHost* rfh = contents->GetMainFrame();
+    if (rfh) {
+      int process_id = rfh->GetProcess()->GetID();
+      int routing_id = rfh->GetRoutingID();
+      int ax_tree_id = AXTreeIDRegistry::GetInstance()->GetOrCreateAXTreeID(
+          process_id, routing_id);
+      out_data->AddIntAttribute(ui::AX_ATTR_CHILD_TREE_ID, ax_tree_id);
+    }
+  }
 }
 
 std::string AXTreeSourceAsh::ToString(

chrome/chrome_browser.gypi

@@ -1916,6 +1916,8 @@
       'browser/accessibility/accessibility_events.h',
       'browser/accessibility/accessibility_extension_api_constants.cc',
       'browser/accessibility/accessibility_extension_api_constants.h',
+      'browser/accessibility/ax_tree_id_registry.cc',
+      'browser/accessibility/ax_tree_id_registry.h',
       'browser/accessibility/invert_bubble_prefs.cc',
       'browser/accessibility/invert_bubble_prefs.h',
       'browser/auto_launch_trial.cc',

chrome/common/extensions/api/automation.idl

@@ -180,6 +180,7 @@
     tooltip,
     valueIndicator,
     webArea,
+    webView,
     window
   };
 
@@ -238,14 +239,11 @@
   // A single node in an Automation tree.
   [nocompile, noinline_doc] dictionary AutomationNode {
     // The root node of the tree containing this AutomationNode.
-    AutomationRootNode root;
+    AutomationNode root;
 
-    // Whether this AutomationNode is an AutomationRootNode.
+    // Whether this AutomationNode is root node.
     boolean isRootNode;
 
-    // Unique ID to identify this node.
-    long id;
-
     // The role of this node.
     automation.RoleType role;
 
@@ -293,35 +291,8 @@
         EventType eventType, AutomationListener listener, boolean capture);
   };
 
-  // Called when the <code>AutomationRootNode</code> for the page is available.
-  callback RootCallback = void(AutomationRootNode rootNode);
-
-  // The root node of the automation tree for a single frame or desktop.
-  // This may be:
-  // <ul>
-  //   <li> The desktop
-  //   <li> The top frame of a page
-  //   <li> A frame or iframe within a page
-  // </ul>
-  // Thus, an <code>AutomationRootNode</code> may be a descendant of one or
-  // more <code>AutomationRootNode</code>s, and in turn have one or more
-  // <code>AutomationRootNode</code>s in its descendants. Thus, the
-  // <code>root</code> property of the <code>AutomationRootNode</code> will be
-  // the immediate parent <code>AutomationRootNode</code>, or <code>null</code>
-  // if this is the top-level <code>AutomationRootNode</code>.
-  //
-  // Extends $(ref:automation.AutomationNode).
-  [nocompile, noinline_doc] dictionary AutomationRootNode {
-    // TODO(aboxhall/dtseng): implement loading. Kept separate to not include
-    // in generated docs.
-
-    // Whether this AutomationRootNode is loaded or not. If false, call load()
-    // to get the contents.
-    boolean loaded;
-
-    // Load the accessibility tree for this AutomationRootNode.
-    static void load(RootCallback callback);
-  };
+  // Called when the <code>AutomationNode</code> for the page is available.
+  callback RootCallback = void(AutomationNode rootNode);
 
   interface Functions {
     // Get the automation tree for the tab with the given tabId, or the current

chrome/common/extensions/api/automation_internal.idl

@@ -46,11 +46,8 @@ namespace automationInternal {
   // tree. See ui/accessibility/ax_tree_update.h for an extended explanation of
   // the tree update format.
   dictionary AXEventParams {
-    // The process id of the renderer host.
-    long processID;
-
-    // The routing id of the web contents that this update is for.
-    long routingID;
+    // The tree id of the web contents that this update is for.
+    long treeID;
 
     // ID of the node that the event applies to.
     long targetID;
@@ -73,8 +70,7 @@ namespace automationInternal {
 
   // Arguments required for all actions supplied to performAction.
   dictionary PerformActionRequiredParams {
-    long processID;
-    long routingID;
+    long treeID;
     long automationNodeID;
     ActionType actionType;
   };
@@ -85,19 +81,22 @@ namespace automationInternal {
     long endIndex;
   };
 
-  // Returns the process id and routing id of the tab whose accessibility was
-  // enabled using enable().
-  callback EnableTabCallback = void(long processID, long routingID);
+  // Returns the accessibility tree id of the web contents who's accessibility
+  // was enabled using enableTab().
+  callback EnableTabCallback = void(long tree_id);
 
   // Callback called when enableDesktop() returns.
   callback EnableDesktopCallback = void();
 
   interface Functions {
     // Enable automation of the tab with the given id, or the active tab if no
-    // tab id is given, and retrieves its process and routing ids for use in
+    // tab id is given, and retrieves accessibility tree id for use in
     // future updates.
     static void enableTab(optional long tabId, EnableTabCallback callback);
 
+    // Enable automation of the frame with the given tree id.
+    static void enableFrame(long tree_id);
+
     // Enables desktop automation.
     static void enableDesktop(EnableDesktopCallback callback);
 
@@ -110,6 +109,6 @@ namespace automationInternal {
     // Fired when an accessibility event occurs
     static void onAccessibilityEvent(AXEventParams update);
 
-    static void onAccessibilityTreeDestroyed(long processID, long routingID);
+    static void onAccessibilityTreeDestroyed(long treeID);
   };
 };

chrome/renderer/resources/extensions/automation/automation_node.js

@@ -40,18 +40,16 @@ AutomationNodeImpl.prototype = {
   },
 
   parent: function() {
-    return this.rootImpl.get(this.parentID);
+    return this.hostTree || this.rootImpl.get(this.parentID);
   },
 
   firstChild: function() {
-    var node = this.rootImpl.get(this.childIds[0]);
-    return node;
+    return this.childTree || this.rootImpl.get(this.childIds[0]);
   },
 
   lastChild: function() {
     var childIds = this.childIds;
-    var node = this.rootImpl.get(childIds[childIds.length - 1]);
-    return node;
+    return this.childTree || this.rootImpl.get(childIds[childIds.length - 1]);
   },
 
   children: function() {
@@ -113,12 +111,18 @@ AutomationNodeImpl.prototype = {
     }
   },
 
+  toJSON: function() {
+    return { treeID: this.treeID,
+             id: this.id,
+             role: this.role,
+             attributes: this.attributes };
+  },
+
   dispatchEvent: function(eventType) {
     var path = [];
     var parent = this.parent();
     while (parent) {
       path.push(parent);
-      // TODO(aboxhall/dtseng): handle unloaded parent node
       parent = parent.parent();
     }
     var event = new AutomationEvent(eventType, this.wrapper);
@@ -194,8 +198,7 @@ AutomationNodeImpl.prototype = {
 
   performAction_: function(actionType, opt_args) {
     // Not yet initialized.
-    if (this.rootImpl.processID === undefined ||
-        this.rootImpl.routingID === undefined ||
+    if (this.rootImpl.treeID === undefined ||
         this.id === undefined) {
       return;
     }
@@ -206,8 +209,7 @@ AutomationNodeImpl.prototype = {
           ' {"interact": true} in the "automation" manifest key.');
     }
 
-    automationInternal.performAction({ processID: this.rootImpl.processID,
-                                       routingID: this.rootImpl.routingID,
+    automationInternal.performAction({ treeID: this.rootImpl.treeID,
                                        automationNodeID: this.id,
                                        actionType: actionType },
                                      opt_args || {});
@@ -255,6 +257,7 @@ var ATTRIBUTE_NAME_TO_ATTRIBUTE_ID = {
  * @const
  */
 var ATTRIBUTE_BLACKLIST = {'activedescendantId': true,
+                           'childTreeId': true,
                            'controlsIds': true,
                            'describedbyIds': true,
                            'flowtoIds': true,
@@ -276,14 +279,13 @@ var ATTRIBUTE_BLACKLIST = {'activedescendantId': true,
  * AutomationNode object.
  * Thus, tree traversals amount to a lookup in our hash.
  *
- * The tree itself is identified by the process id and routing id of the
+ * The tree itself is identified by the accessibility tree id of the
  * renderer widget host.
  * @constructor
  */
-function AutomationRootNodeImpl(processID, routingID) {
+function AutomationRootNodeImpl(treeID) {
   AutomationNodeImpl.call(this, this);
-  this.processID = processID;
-  this.routingID = routingID;
+  this.treeID = treeID;
   this.axNodeDataCache_ = {};
 }
 
@@ -351,6 +353,10 @@ AutomationRootNodeImpl.prototype = {
   },
 
   destroy: function() {
+    if (this.hostTree)
+      this.hostTree.childTree = undefined;
+    this.hostTree = undefined;
+
     this.dispatchEvent(schema.EventType.destroyed);
     this.invalidate_(this.wrapper);
   },
@@ -406,19 +412,10 @@ AutomationRootNodeImpl.prototype = {
       nodeImpl[key] = AutomationAttributeDefaults[key];
     }
     nodeImpl.childIds = [];
-    nodeImpl.loaded = false;
     nodeImpl.id = id;
     delete this.axNodeDataCache_[id];
   },
 
-  load: function(callback) {
-    // TODO(dtseng/aboxhall): Implement.
-    if (!this.loaded)
-      throw 'Unsupported state: root node is not loaded.';
-
-    setTimeout(callback, 0);
-  },
-
   deleteOldChildren_: function(node, newChildIds) {
     // Create a set of child ids in |src| for fast lookup, and return false
     // if a duplicate is found;
@@ -457,6 +454,7 @@ AutomationRootNodeImpl.prototype = {
   createNewChildren_: function(node, newChildIds, updateState) {
     logging.CHECK(node);
     var success = true;
+
     for (var i = 0; i < newChildIds.length; i++) {
       var childId = newChildIds[i];
       var childNode = this.axNodeDataCache_[childId];
@@ -495,6 +493,23 @@ AutomationRootNodeImpl.prototype = {
 
   setData_: function(node, nodeData) {
     var nodeImpl = privates(node).impl;
+
+    // TODO(dtseng): Make into set listing all hosting node roles.
+    if (nodeData.role == schema.RoleType.webView) {
+      if (nodeImpl.pendingChildFrame === undefined)
+        nodeImpl.pendingChildFrame = true;
+
+      if (nodeImpl.pendingChildFrame) {
+        nodeImpl.childTreeID = nodeData.intAttributes.childTreeId;
+        automationInternal.enableFrame(nodeImpl.childTreeID);
+        automationUtil.storeTreeCallback(nodeImpl.childTreeID, function(root) {
+          nodeImpl.pendingChildFrame = false;
+          nodeImpl.childTree = root;
+          privates(root).impl.hostTree = node;
+          nodeImpl.dispatchEvent(schema.EventType.childrenChanged);
+        });
+      }
+    }
     for (var key in AutomationAttributeDefaults) {
       if (key in nodeData)
         nodeImpl[key] = nodeData[key];
@@ -599,19 +614,19 @@ var AutomationNode = utils.expose('AutomationNode',
                                                 'makeVisible',
                                                 'setSelection',
                                                 'addEventListener',
-                                                'removeEventListener'],
+                                                'removeEventListener',
+                                                'toJSON'],
                                     readonly: ['isRootNode',
                                                'role',
                                                'state',
                                                'location',
                                                'attributes',
+                                               'indexInParent',
                                                'root'] });
 
 var AutomationRootNode = utils.expose('AutomationRootNode',
                                       AutomationRootNodeImpl,
-                                      { superclass: AutomationNode,
-                                        functions: ['load'],
-                                        readonly: ['loaded'] });
+                                      { superclass: AutomationNode });
 
 exports.AutomationNode = AutomationNode;
 exports.AutomationRootNode = AutomationRootNode;

chrome/renderer/resources/extensions/automation_custom_bindings.js

@@ -15,21 +15,33 @@ var lastError = require('lastError');
 var logging = requireNative('logging');
 var schema = requireNative('automationInternal').GetSchemaAdditions();
 
+/**
+ * A namespace to export utility functions to other files in automation.
+ */
+window.automationUtil = function() {};
+
 // TODO(aboxhall): Look into using WeakMap
 var idToAutomationRootNode = {};
 var idToCallback = {};
 
-// TODO(dtseng): Move out to automation/automation_util.js or as a static member
-// of AutomationRootNode to keep this file clean.
-/*
- * Creates an id associated with a particular AutomationRootNode based upon a
- * renderer/renderer host pair's process and routing id.
- */
-var createAutomationRootNodeID = function(pid, rid) {
-  return pid + '_' + rid;
-};
+var DESKTOP_TREE_ID = 0;
 
-var DESKTOP_TREE_ID = createAutomationRootNodeID(0, 0);
+automationUtil.storeTreeCallback = function(id, callback) {
+  if (!callback)
+    return;
+
+  var targetTree = idToAutomationRootNode[id];
+  if (!targetTree) {
+    // If we haven't cached the tree, hold the callback until the tree is
+    // populated by the initial onAccessibilityEvent call.
+    if (id in idToCallback)
+      idToCallback[id].push(callback);
+    else
+      idToCallback[id] = [callback];
+  } else {
+    callback(targetTree);
+  }
+};
 
 automation.registerCustomHook(function(bindingsAPI) {
   var apiFunctions = bindingsAPI.apiFunctions;
@@ -37,35 +49,25 @@ automation.registerCustomHook(function(bindingsAPI) {
   // TODO(aboxhall, dtseng): Make this return the speced AutomationRootNode obj.
   apiFunctions.setHandleRequest('getTree', function getTree(tabId, callback) {
     // enableTab() ensures the renderer for the active or specified tab has
-    // accessibility enabled, and fetches its process and routing ids to use as
-    // a key in the idToAutomationRootNode map. The callback to enableTab is is
-    // bound to the callback passed in to getTree(), so that once the tree is
-    // available (either due to having been cached earlier, or after an
-    // accessibility event occurs which causes the tree to be populated), the
+    // accessibility enabled, and fetches its ax tree id to use as
+    // a key in the idToAutomationRootNode map. The callback to
+    // enableTab is bound to the callback passed in to getTree(), so that once
+    // the tree is available (either due to having been cached earlier, or after
+    // an accessibility event occurs which causes the tree to be populated), the
     // callback can be called.
-    automationInternal.enableTab(tabId, function onEnable(pid, rid) {
+    automationInternal.enableTab(tabId, function onEnable(id) {
       if (lastError.hasError(chrome)) {
         callback();
         return;
       }
-      var id = createAutomationRootNodeID(pid, rid);
-      var targetTree = idToAutomationRootNode[id];
-      if (!targetTree) {
-        // If we haven't cached the tree, hold the callback until the tree is
-        // populated by the initial onAccessibilityEvent call.
-        if (id in idToCallback)
-          idToCallback[id].push(callback);
-        else
-          idToCallback[id] = [callback];
-      } else {
-        callback(targetTree);
-      }
+      automationUtil.storeTreeCallback(id, callback);
     });
   });
 
   var desktopTree = null;
   apiFunctions.setHandleRequest('getDesktop', function(callback) {
-    desktopTree = idToAutomationRootNode[DESKTOP_TREE_ID];
+    desktopTree =
+        idToAutomationRootNode[DESKTOP_TREE_ID];
     if (!desktopTree) {
       if (DESKTOP_TREE_ID in idToCallback)
         idToCallback[DESKTOP_TREE_ID].push(callback);
@@ -76,7 +78,8 @@ automation.registerCustomHook(function(bindingsAPI) {
       // scope.
       automationInternal.enableDesktop(function() {
         if (lastError.hasError(chrome)) {
-          delete idToAutomationRootNode[DESKTOP_TREE_ID];
+          delete idToAutomationRootNode[
+              DESKTOP_TREE_ID];
           callback();
           return;
         }
@@ -91,15 +94,13 @@ automation.registerCustomHook(function(bindingsAPI) {
 // essentially a proxy for the AccessibilityHostMsg_Events IPC from the
 // renderer.
 automationInternal.onAccessibilityEvent.addListener(function(data) {
-  var pid = data.processID;
-  var rid = data.routingID;
-  var id = createAutomationRootNodeID(pid, rid);
+  var id = data.treeID;
   var targetTree = idToAutomationRootNode[id];
   if (!targetTree) {
     // If this is the first time we've gotten data for this tree, it will
     // contain all of the tree's data, so create a new tree which will be
     // bootstrapped from |data|.
-    targetTree = new AutomationRootNode(pid, rid);
+    targetTree = new AutomationRootNode(id);
     idToAutomationRootNode[id] = targetTree;
   }
   if (!privates(targetTree).impl.onAccessibilityEvent(data))
@@ -129,8 +130,7 @@ automationInternal.onAccessibilityEvent.addListener(function(data) {
   delete idToCallback[id];
 });
 
-automationInternal.onAccessibilityTreeDestroyed.addListener(function(pid, rid) {
-  var id = createAutomationRootNodeID(pid, rid);
+automationInternal.onAccessibilityTreeDestroyed.addListener(function(id) {
   var targetTree = idToAutomationRootNode[id];
   if (targetTree) {
     privates(targetTree).impl.destroy();

chrome/test/data/extensions/api_test/automation/tests/desktop/common.js

@@ -25,9 +25,31 @@ function findAutomationNode(root, condition) {
   return null;
 }
 
-function setupAndRunTests(allTests) {
-  chrome.automation.getDesktop(function(rootNodeArg) {
-    rootNode = rootNodeArg;
-    chrome.test.runTests(allTests);
+function runWithDocument(docString, callback) {
+  var url = 'data:text/html,<!doctype html>' + docString;
+  var createParams = {
+    active: true,
+    url: url
+  };
+  chrome.tabs.create(createParams, function(tab) {
+    chrome.tabs.onUpdated.addListener(function(tabId, changeInfo) {
+      if (tabId == tab.id && changeInfo.status == 'complete') {
+        callback();
+      }
+    });
   });
 }
+
+function setupAndRunTests(allTests, opt_docString) {
+  function runTestInternal() {
+    chrome.automation.getDesktop(function(rootNodeArg) {
+      rootNode = rootNodeArg;
+      chrome.test.runTests(allTests);
+    });
+  }
+
+  if (opt_docString)
+    runWithDocument(opt_docString, runTestInternal);
+  else
+    runTestInternal();
+}

chrome/test/data/extensions/api_test/automation/tests/desktop/load_tabs.html

+<!--
+ * Copyright 2014 The Chromium Authors. All rights reserved.  Use of this
+ * source code is governed by a BSD-style license that can be found in the
+ * LICENSE file.
+-->
+<script src="common.js"></script>
+<script src="load_tabs.js"></script>

chrome/test/data/extensions/api_test/automation/tests/desktop/load_tabs.js

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function getAllWebViews() {
+  function findAllWebViews(node, nodes) {
+    if (node.role == chrome.automation.RoleType.webView)
+      nodes.push(node);
+
+    var children = node.children();
+    for (var i = 0; i < children.length; i++) {
+      var child = findAllWebViews(children[i], nodes);
+    }
+  }
+
+  var webViews = [];
+  findAllWebViews(rootNode, webViews);
+  return webViews;
+};
+
+var allTests = [
+  function testLoadTabs() {
+    var webViews = getAllWebViews();
+    assertEq(2, webViews.length);
+
+    // Test spins up more quickly than the load; listen for the childrenChanged
+    // event.
+    webViews[1].addEventListener(chrome.automation.EventType.childrenChanged,
+        function(evt) {
+          var subroot = webViews[1].firstChild();
+          assertEq(evt.target, subroot.parent());
+
+          var button = subroot.firstChild().firstChild();
+          assertEq(chrome.automation.RoleType.button, button.role);
+
+          var input = subroot.firstChild().lastChild().previousSibling();
+          assertEq(chrome.automation.RoleType.textField, input.role);
+          chrome.test.succeed();
+    }, true);
+  },
+
+  function testSubevents() {
+    var button = null;
+    var webViews = getAllWebViews();
+    var subroot = webViews[1].firstChild();
+
+    rootNode.addEventListener(chrome.automation.EventType.focus,
+        function(evt) {
+          assertEq(button, evt.target);
+          chrome.test.succeed();
+        },
+        false);
+
+    button = subroot.firstChild().firstChild();
+    button.focus();
+  }
+];
+
+setupAndRunTests(allTests,
+                 '<button>alpha</button><input type="text">hello</input>');

chrome/test/data/extensions/api_test/automation/tests/unit/test.js

@@ -6,6 +6,9 @@ chrome.test.runWithModuleSystem(function(moduleSystem) {
   window.AutomationRootNode =
       moduleSystem.require('automationNode').AutomationRootNode;
   window.privates = moduleSystem.privates;
+  // Unused.
+  window.automationUtil = function() {};
+  window.automationUtil.storeTreeCallback = function() {};
 });
 
 var assertEq = chrome.test.assertEq;

ui/accessibility/ax_enums.idl

@@ -189,6 +189,7 @@
     tooltip,
     value_indicator,
     web_area,
+    web_view,
     window
   };
 
@@ -293,7 +294,13 @@
     color_value_blue,
 
     // Inline text attributes.
-    text_direction
+    text_direction,
+
+    // Uniquely identifies an AXTree.
+    tree_id,
+
+    // Identifies a child tree which this node hosts.
+    child_tree_id
   };
 
   [cpp_enum_prefix_override="ax_attr"] enum AXFloatAttribute {

ui/accessibility/ax_node_data.cc

@@ -203,6 +203,12 @@ std::string AXNodeData::ToString() const {
       case AX_ATTR_COLOR_VALUE_BLUE:
         result += " color_value_blue=" + value;
         break;
+      case AX_ATTR_TREE_ID:
+        result += " tree_id=" + value;
+        break;
+      case AX_ATTR_CHILD_TREE_ID:
+        result += " child_tree_id=" + value;
+        break;
       case AX_ATTR_TEXT_DIRECTION:
         switch (int_attributes[i].second) {
           case AX_TEXT_DIRECTION_LR:

ui/views/accessibility/ax_view_obj_wrapper.cc

@@ -42,6 +42,7 @@ void AXViewObjWrapper::GetChildren(
 void AXViewObjWrapper::Serialize(ui::AXNodeData* out_node_data) {
   ui::AXViewState view_data;
   view_->GetAccessibleState(&view_data);
+
   out_node_data->id = GetID();
   out_node_data->role = view_data.role;
 
@@ -58,10 +59,13 @@ void AXViewObjWrapper::Serialize(ui::AXNodeData* out_node_data) {
   out_node_data->AddStringAttribute(
       ui::AX_ATTR_VALUE, base::UTF16ToUTF8(view_data.value));
 
-  out_node_data->AddIntAttribute(ui::AX_ATTR_TEXT_SEL_START,
-                                 view_data.selection_start);
-  out_node_data->AddIntAttribute(ui::AX_ATTR_TEXT_SEL_END,
-                                 view_data.selection_end);
+  if (view_data.selection_start > -1 && view_data.selection_end > -1) {
+    out_node_data->AddIntAttribute(ui::AX_ATTR_TEXT_SEL_START,
+                                   view_data.selection_start);
+
+    out_node_data->AddIntAttribute(ui::AX_ATTR_TEXT_SEL_END,
+                                   view_data.selection_end);
+  }
 }
 
 int32 AXViewObjWrapper::GetID() {

ui/views/accessibility/ax_view_obj_wrapper.h

@@ -16,6 +16,8 @@ class AXViewObjWrapper : public AXAuraObjWrapper {
   explicit AXViewObjWrapper(View* view);
   ~AXViewObjWrapper() override;
 
+  View* view() { return view_; }
+
   // AXAuraObjWrapper overrides.
   AXAuraObjWrapper* GetParent() override;
   void GetChildren(std::vector<AXAuraObjWrapper*>* out_children) override;

ui/views/accessibility/native_view_accessibility_win.cc

@@ -1331,6 +1331,8 @@ int32 NativeViewAccessibilityWin::MSAARole(ui::AXRole role) {
       return ROLE_SYSTEM_TITLEBAR;
     case ui::AX_ROLE_TOOLBAR:
       return ROLE_SYSTEM_TOOLBAR;
+    case ui::AX_ROLE_WEB_VIEW:
+      return ROLE_SYSTEM_GROUPING;
     case ui::AX_ROLE_WINDOW:
       return ROLE_SYSTEM_WINDOW;
     case ui::AX_ROLE_CLIENT:

ui/views/controls/webview/webview.cc

@@ -210,7 +210,7 @@ void WebView::AboutToRequestFocusFromTabTraversal(bool reverse) {
 }
 
 void WebView::GetAccessibleState(ui::AXViewState* state) {
-  state->role = ui::AX_ROLE_GROUP;
+  state->role = ui::AX_ROLE_WEB_VIEW;
 }
 
 gfx::NativeViewAccessible WebView::GetNativeViewAccessible() {