Fix accessibility with out-of-process iframes.

This patch changes the accessibility tree to attach to lookup the RemoteFrame instead of the RenderFrameImpl (which should not exist).

This is a reland of https://codereview.chromium.org/1155993003/.

BUG=490831

Review URL: https://codereview.chromium.org/1228493004

Cr-Commit-Position: refs/heads/master@{#339121}

2 files changed, 57 insertions, 0 deletions

diff --git a/content/public/test/browser_test_utils.cc b/content/public/test/browser_test_utils.cc
index bbae7f8..8d380a5 100644
--- a/content/public/test/browser_test_utils.cc
+++ b/content/public/test/browser_test_utils.cc
@@ -1009,4 +1009,39 @@ void FrameWatcher::WaitFrames(int frames_to_wait) {
   run_loop.Run();
 }
 
+RenderFrameDeletedObserver::RenderFrameDeletedObserver(
+    RenderFrameHost* rfh)
+    : WebContentsObserver(WebContents::FromRenderFrameHost(rfh)),
+      process_id_(rfh->GetProcess()->GetID()),
+      routing_id_(rfh->GetRoutingID()),
+      deleted_(false) {
+}
+
+RenderFrameDeletedObserver::~RenderFrameDeletedObserver() {
+}
+
+void RenderFrameDeletedObserver::RenderFrameDeleted(
+    RenderFrameHost* render_frame_host) {
+  if (render_frame_host->GetProcess()->GetID() == process_id_ &&
+      render_frame_host->GetRoutingID() == routing_id_) {
+    deleted_ = true;
+
+    if (runner_.get())
+      runner_->Quit();
+  }
+}
+
+bool RenderFrameDeletedObserver::deleted() {
+  return deleted_;
+}
+
+void RenderFrameDeletedObserver::WaitUntilDeleted() {
+  if (deleted_)
+    return;
+
+  runner_.reset(new base::RunLoop());
+  runner_->Run();
+  runner_.reset();
+}
+
 }  // namespace content
diff --git a/content/public/test/browser_test_utils.h b/content/public/test/browser_test_utils.h
index 72bbd02..bd5cddc 100644
--- a/content/public/test/browser_test_utils.h
+++ b/content/public/test/browser_test_utils.h
@@ -432,6 +432,28 @@ class FrameWatcher : public BrowserMessageFilter {
   DISALLOW_COPY_AND_ASSIGN(FrameWatcher);
 };
 
+// This observer keeps track of the last deleted RenderFrame to avoid
+// accessing it and causing use-after-free condition.
+class RenderFrameDeletedObserver : public WebContentsObserver {
+ public:
+  RenderFrameDeletedObserver(RenderFrameHost* rfh);
+  ~RenderFrameDeletedObserver() override;
+
+  // Overridden WebContentsObserver methods.
+  void RenderFrameDeleted(RenderFrameHost* render_frame_host) override;
+
+  void WaitUntilDeleted();
+  bool deleted();
+
+ private:
+  int process_id_;
+  int routing_id_;
+  bool deleted_;
+  scoped_ptr<base::RunLoop> runner_;
+
+  DISALLOW_COPY_AND_ASSIGN(RenderFrameDeletedObserver);
+};
+
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_TEST_BROWSER_TEST_UTILS_H_