commit 77f64ca0139092c3e2cf48b1017c47c9c04f2d17
author Aaron Leventhal <aleventhal@google.com> Wed Sep 20 16:02:23 2023
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Wed Sep 20 16:02:23 2023
tree 0878de6169a256848bac4ecab8cd8ac2f9293971
parent 7a08636312c6c694a623cb67a3a8dd6b683cbc7f

Speculative fix for IsBlockedByAriaModalDialog()

ParentObject() may not return a useful object in all cases.
With this change, it will be sure to return nullptr if the
subtree was detached during a missing parent repair attempt.
TODO: audit all uses of ParentObject() and be sure they
gracefully handle nullptr cases.

Fixed: 1475135
Change-Id: I4e66d4fc91c6fd32cf0c6bcd02152b2c2a43dec3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4873760
Commit-Queue: Benjamin Beaudry <benjamin.beaudry@microsoft.com>
Reviewed-by: Benjamin Beaudry <benjamin.beaudry@microsoft.com>
Cr-Commit-Position: refs/heads/main@{#1199038}

third_party/blink/renderer/modules/accessibility/ax_object.cc

diff --git a/third_party/blink/renderer/modules/accessibility/ax_object.cc b/third_party/blink/renderer/modules/accessibility/ax_object.cc
index b27693c..3dc62f5 100644
--- a/third_party/blink/renderer/modules/accessibility/ax_object.cc
+++ b/third_party/blink/renderer/modules/accessibility/ax_object.cc
@@ -3501,7 +3501,7 @@
     return false;
   }
 
-  if (!GetNode() || GetNode()->IsPseudoElement()) {
+  if ((!GetNode() || GetNode()->IsPseudoElement()) && ParentObject()) {
     return ParentObject()->IsBlockedByAriaModalDialog();
   }
 
@@ -5600,15 +5600,22 @@
 }
 
 AXObject* AXObject::ParentObject() const {
-  if (IsDetached())
+  if (IsDetached()) {
     return nullptr;
+  }
 
   // This can happen when an object in the middle of the tree is suddenly
   // detached, but the children still exist. One example of this is when
   // a <select size="1"> changes to <select size="2">, where the
   // Role::kMenuListPopup is detached.
-  if (IsMissingParent())
+  if (IsMissingParent()) {
     RepairMissingParent();
+    // If the parent cannot be repaired, the entire subtree rooted at this node
+    // will be detached.
+    if (IsDetached()) {
+      return nullptr;
+    }
+  }
 
   return parent_;
 }