Control worst-case for text alternative calc

Prevent name calculation from getting out of control on really large
regions, e.g. scrollable areas.

Bug: None
Change-Id: I996a15ba6d6b56df0af7975f1aca861eadf7adfc
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2117454Reviewed-by: Dominic Mazzoni <dmazzoni@chromium.org>
Commit-Queue: Aaron Leventhal <aleventhal@chromium.org>
Cr-Commit-Position: refs/heads/master@{#753278}

third_party/blink/renderer/modules/accessibility/ax_node_object.cc

@@ -2441,6 +2441,9 @@ String AXNodeObject::TextFromDescendants(AXObjectSet& visited,
     children.push_back(owned_child);
 
   for (AXObject* child : children) {
+    constexpr size_t kMaxDescendantsForTextAlternativeComputation = 100;
+    if (visited.size() > kMaxDescendantsForTextAlternativeComputation + 1)
+      break;  // Need to add 1 because the root naming node is in the list.
     // If a child is a continuation, we should ignore attributes like
     // hidden and presentational. See LAYOUT TREE WALKING ALGORITHM in
     // ax_layout_object.cc for more information on continuations.

third_party/blink/web_tests/accessibility/name-calc-recursive.html

@@ -22,6 +22,25 @@
   <table role="table"><tr><td>cell</td></tr></table>
 </div>
 
+<!-- Chrome will use a maximum of 100 descendants in the recursive name calc -->
+<a id="a-truncate-because-too-many-nodes" href="#">
+  <span>a1</span><span>2<span><span>3</span>4</span></span><span>5</span><span>6</span><span>7</span><span>8</span><span>9</span><span>0</span>
+  <span>b1</span><span>2<span><span>3</span>4</span></span><span>5</span><span>6</span><span>7</span><span>8</span><span>9</span><span>0</span>
+  <span>c1</span><span>2<span><span>3</span>4</span></span><span>5</span><span>6</span><span>7</span><span>8</span><span>9</span><span>0</span>
+  <span>d1</span><span>2<span><span>3</span>4</span></span><span>5</span><span>6</span><span>7</span><span>8</span><span>9</span><span>0</span>
+  <span>e1</span><span>2<span><span>3</span>4</span></span><span>5</span><span>6</span><span>7</span><span>8</span><span>9</span><span>0</span>
+  <span>f1</span><span>2<span><span>3</span>4</span></span><span>5</span><span>6</span><span>7</span><span>8</span><span>9</span><span>0</span>
+  <span>g1</span><span>2<span><span>3</span>4</span></span><span>5</span><span>6</span><span>7</span><span>8</span><span>9</span><span>0</span>
+  <span>h1</span><span>2<span><span>3</span>4</span></span><span>5</span><span>6</span><span>7</span><span>8</span><span>9</span><span>0</span>
+  <span>i1</span><span>2<span><span>3</span>4</span></span><span>5</span><span>6</span><span>7</span><span>8</span><span>9</span><span>0</span>
+  <span>j1</span><span>2<span><span>3</span>4</span></span><span>5</span><span>6</span><span>7</span><span>8</span><span>9</span><span>0</span>
+  <span>Extra-A</span>
+  <span>Extra-B</span>
+  <span>Extra-C</span>
+</button>
+
+
+
 <script>
 test(function(t) {
   const snippets = [
@@ -29,6 +48,7 @@ test(function(t) {
     [ 'a-dfn', 'definition' ],
     [ 'a-p', 'paragraph' ],
     [ 'a-time', '12/04/2016' ],
+    [ 'a-truncate-because-too-many-nodes', 'a1234567890b1234567890c1234567890d1234567890e1234567890f1234567890g1234567890h1234567890i1234567890j1234567890' ],
   ];
   for (let [ id, expectedName ] of snippets) {
     let a = accessibilityController.accessibleElementById(id);