Fix AXPlatformNodeWin::Navigate DCHECK with PDF loaded

This is similar to the issue fixed in crrev.com/c/1532893 and follow-up
crrev.com/c/1535165. When the PDF plugin sends its accessibility tree
to the browser process, we would incorrectly detect that the PDF tree
is the root tree and switch out the node tracked by the UIA fragment
root as its lone child. The fix is to check for a parent tree ID when
determining whether a given tree is the root tree.

Bug: 968245
Change-Id: I91a193064a51f9694eb4338af7a12f2fbf22dd30
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1636480Reviewed-by: Nektarios Paisios <nektar@chromium.org>
Commit-Queue: Kevin Babbitt <kbabbitt@microsoft.com>
Cr-Commit-Position: refs/heads/master@{#665222}

content/browser/accessibility/browser_accessibility_manager.cc

@@ -1324,7 +1324,8 @@ BrowserAccessibilityManager::GetDelegateFromRootManager() {
 }
 
 bool BrowserAccessibilityManager::IsRootTree() {
-  return delegate()->AccessibilityIsMainFrame();
+  return delegate()->AccessibilityIsMainFrame() &&
+         GetTreeData().parent_tree_id == ui::AXTreeIDUnknown();
 }
 
 // static

content/browser/accessibility/browser_accessibility_manager_win_unittest.cc

@@ -82,4 +82,61 @@ TEST_F(BrowserAccessibilityManagerWinTest, DynamicallyAddedIFrame) {
             root_document_root_node->GetNativeViewAccessible());
 }
 
+TEST_F(BrowserAccessibilityManagerWinTest, ChildTree) {
+  base::CommandLine::ForCurrentProcess()->AppendSwitch(
+      ::switches::kEnableExperimentalUIAutomation);
+
+  ui::AXNodeData child_tree_root;
+  child_tree_root.id = 1;
+  child_tree_root.role = ax::mojom::Role::kRootWebArea;
+  ui::AXTreeUpdate child_tree_update = MakeAXTreeUpdate(child_tree_root);
+
+  ui::AXNodeData parent_tree_root;
+  parent_tree_root.id = 1;
+  parent_tree_root.role = ax::mojom::Role::kRootWebArea;
+  parent_tree_root.AddStringAttribute(
+      ax::mojom::StringAttribute::kChildTreeId,
+      child_tree_update.tree_data.tree_id.ToString());
+  ui::AXTreeUpdate parent_tree_update = MakeAXTreeUpdate(parent_tree_root);
+
+  child_tree_update.tree_data.parent_tree_id =
+      parent_tree_update.tree_data.tree_id;
+
+  test_browser_accessibility_delegate_->accelerated_widget_ =
+      gfx::kMockAcceleratedWidget;
+
+  std::unique_ptr<BrowserAccessibilityManager> parent_manager(
+      BrowserAccessibilityManager::Create(
+          parent_tree_update, test_browser_accessibility_delegate_.get(),
+          new BrowserAccessibilityFactory()));
+
+  ui::AXPlatformNode* root_document_root_node =
+      ui::AXPlatformNode::FromNativeViewAccessible(
+          parent_manager->GetRoot()->GetNativeViewAccessible());
+
+  std::unique_ptr<ui::AXPlatformNodeDelegate> fragment_root =
+      std::make_unique<ui::AXFragmentRootWin>(
+          gfx::kMockAcceleratedWidget,
+          static_cast<ui::AXPlatformNodeWin*>(root_document_root_node));
+
+  EXPECT_EQ(fragment_root->GetChildCount(), 1);
+  EXPECT_EQ(fragment_root->ChildAtIndex(0),
+            root_document_root_node->GetNativeViewAccessible());
+
+  // Add the child tree.
+  std::unique_ptr<TestBrowserAccessibilityDelegate> child_tree_delegate =
+      std::make_unique<TestBrowserAccessibilityDelegate>();
+  child_tree_delegate->is_root_frame_ = true;
+  child_tree_delegate->accelerated_widget_ = gfx::kMockAcceleratedWidget;
+  std::unique_ptr<BrowserAccessibilityManager> child_manager(
+      BrowserAccessibilityManager::Create(child_tree_update,
+                                          child_tree_delegate.get(),
+                                          new BrowserAccessibilityFactory()));
+
+  // The fragment root's lone child should still be the same as before.
+  EXPECT_EQ(fragment_root->GetChildCount(), 1);
+  EXPECT_EQ(fragment_root->ChildAtIndex(0),
+            root_document_root_node->GetNativeViewAccessible());
+}
+
 }  // namespace content