commit 7fdf612530e5a4e4639964f73a1d41a536d94982
author Greg Thompson <grt@chromium.org> Tue Apr 15 15:22:36 2025
committer Chromium LUCI CQ <chromium-scoped@luci-project-accounts.iam.gserviceaccount.com> Tue Apr 15 15:22:36 2025
tree c9fd855924eb9599eef20816475275c639f4f553
parent afbd1d8fc927cc05f45b2534936ac60a7dc457db

[accessibility] Platform node lifetime cleanups

Add `AXPlatformNode::IsDestroyed()`, which returns true for a platform
node after its owner (its delegate, generally speaking) has reset its
`Pointer` to it, thereby calling its `Destroy()` method. A platform node
can be in this state on platforms such as Windows, where the instance's
dtor is called only once all outstanding references have been released.
During this period when a platform node is in this `IsDestroyed()`
state, there is no way for ordinary Chromium code to call any methods on
the platform node. Any such use is effectively a UaF (even if the dtor
has yet to be called and the memory is still valid in the heap). The
only use of a platform node after `Destroy()` that is permissible is an
inbound call via COM from a reference holder (i.e., an AT). The AT may
not know that the node has been destroyed (possibly because it ignored
an event or something). Every such call must be handled by immediately
returning UIA_E_ELEMENTNOTAVAILABLE or E_INVALIDARG. Anything else is a
bug.

Henceforth calls to `AXPlatformNode::GetDelegate()` will crash the
process if called on a destroyed instance. Calls to check for a null
delegate have been replaced with calls to `IsDestroyed()`, which more
clearly expresses developer intent.

Bug: none
AX-Relnotes: n/a.
Change-Id: I9d19e25015a1494d9ce96f052f06b764ed1a284c
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/5741467
Reviewed-by: Aaron Leventhal <aleventhal@chromium.org>
Reviewed-by: Benjamin Beaudry <benjamin.beaudry@microsoft.com>
Commit-Queue: Greg Thompson <grt@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1447134}