[unseasoned-pdf] Call PdfViewWebPlugin a11y methods asyncly

Calling a11y methods asyncly protects against the self-deletions they
may cause. The a11y methods call
content::RenderAccessibility::GenerateAXID() underneath, which may
cause a relayout which causes the PdfViewWebPlugin to be deleted.

Isolating the calls in posted tasks is a clean way to protect against
continuing control flow in the object after it is deleted.

Bug: 1274376
Change-Id: Iffd610a95199826fea56d7f23cb8e344657631d3
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/3313692
Reviewed-by: Lei Zhang <thestig@chromium.org>
Commit-Queue: Daniel Hosseinian <dhoss@chromium.org>
Cr-Commit-Position: refs/heads/main@{#948105}

pdf/pdf_view_web_plugin.cc

@@ -852,9 +852,9 @@ void PdfViewWebPlugin::SetFormTextFieldInFocus(bool in_focus) {
 
 void PdfViewWebPlugin::SetAccessibilityDocInfo(
     const AccessibilityDocInfo& doc_info) {
-  if (!pdf_accessibility_data_handler_)
-    return;
-  pdf_accessibility_data_handler_->SetAccessibilityDocInfo(doc_info);
+  base::ThreadTaskRunnerHandle::Get()->PostTask(
+      FROM_HERE, base::BindOnce(&PdfViewWebPlugin::OnSetAccessibilityDocInfo,
+                                weak_factory_.GetWeakPtr(), doc_info));
 }
 
 void PdfViewWebPlugin::SetAccessibilityPageInfo(
@@ -862,16 +862,15 @@ void PdfViewWebPlugin::SetAccessibilityPageInfo(
     std::vector<AccessibilityTextRunInfo> text_runs,
     std::vector<AccessibilityCharInfo> chars,
     AccessibilityPageObjects page_objects) {
-  if (!pdf_accessibility_data_handler_)
-    return;
-  pdf_accessibility_data_handler_->SetAccessibilityPageInfo(
-      page_info, text_runs, chars, page_objects);
+  base::ThreadTaskRunnerHandle::Get()->PostTask(
+      FROM_HERE, base::BindOnce(&PdfViewWebPlugin::OnSetAccessibilityPageInfo,
+                                weak_factory_.GetWeakPtr(),
+                                std::move(page_info), std::move(text_runs),
+                                std::move(chars), std::move(page_objects)));
 }
 
 void PdfViewWebPlugin::SetAccessibilityViewportInfo(
     const AccessibilityViewportInfo& viewport_info) {
-  // The accessibility tree cannot be updated within the scope of
-  // `UpdateGeometry`.
   base::ThreadTaskRunnerHandle::Get()->PostTask(
       FROM_HERE,
       base::BindOnce(&PdfViewWebPlugin::OnSetAccessibilityViewportInfo,
@@ -1053,11 +1052,32 @@ void PdfViewWebPlugin::OnInvokePrintDialog(int32_t /*result*/) {
   client_->Print(Container()->GetElement());
 }
 
+void PdfViewWebPlugin::OnSetAccessibilityDocInfo(
+    AccessibilityDocInfo doc_info) {
+  if (!pdf_accessibility_data_handler_)
+    return;
+  pdf_accessibility_data_handler_->SetAccessibilityDocInfo(doc_info);
+  // `this` may be deleted. Don't do anything else.
+}
+
+void PdfViewWebPlugin::OnSetAccessibilityPageInfo(
+    AccessibilityPageInfo page_info,
+    std::vector<AccessibilityTextRunInfo> text_runs,
+    std::vector<AccessibilityCharInfo> chars,
+    AccessibilityPageObjects page_objects) {
+  if (!pdf_accessibility_data_handler_)
+    return;
+  pdf_accessibility_data_handler_->SetAccessibilityPageInfo(
+      page_info, text_runs, chars, page_objects);
+  // `this` may be deleted. Don't do anything else.
+}
+
 void PdfViewWebPlugin::OnSetAccessibilityViewportInfo(
-    const AccessibilityViewportInfo& viewport_info) {
+    AccessibilityViewportInfo viewport_info) {
   if (!pdf_accessibility_data_handler_)
     return;
   pdf_accessibility_data_handler_->SetAccessibilityViewportInfo(viewport_info);
+  // `this` may be deleted. Don't do anything else.
 }
 
 pdf::mojom::PdfService* PdfViewWebPlugin::GetPdfService() {

pdf/pdf_view_web_plugin.h

@@ -338,10 +338,21 @@ class PdfViewWebPlugin final : public PdfViewPluginBase,
   // the plugin are moved off the main thread.
   void OnInvokePrintDialog(int32_t /*result*/);
 
-  // Callback to set the viewport information in accessibility tree
+  // Callback to set the document information in the accessibility tree
   // asynchronously.
-  void OnSetAccessibilityViewportInfo(
-      const AccessibilityViewportInfo& viewport_info);
+  void OnSetAccessibilityDocInfo(AccessibilityDocInfo doc_info);
+
+  // Callback to set the page information in the accessibility tree
+  // asynchronously.
+  void OnSetAccessibilityPageInfo(
+      AccessibilityPageInfo page_info,
+      std::vector<AccessibilityTextRunInfo> text_runs,
+      std::vector<AccessibilityCharInfo> chars,
+      AccessibilityPageObjects page_objects);
+
+  // Callback to set the viewport information in the accessibility tree
+  // asynchronously.
+  void OnSetAccessibilityViewportInfo(AccessibilityViewportInfo viewport_info);
 
   // May be null in unit tests.
   pdf::mojom::PdfService* GetPdfService();