Bug 1319640: Make obtaining of plugin IAccessible go through Chrome process on Sandboxed builds; r=tbsaunde

MozReview-Commit-ID: DQnOwJ1VpYS

accessible/ipc/DocAccessibleParent.cpp

@@ -486,6 +486,37 @@ DocAccessibleParent::RecvCOMProxy(const IAccessibleHolder& aCOMProxy,
   aParentCOMProxy->Set(IAccessibleHolder::COMPtrType(rawNative));
   return IPC_OK();
 }
+
+mozilla::ipc::IPCResult
+DocAccessibleParent::RecvGetWindowedPluginIAccessible(
+      const WindowsHandle& aHwnd, IAccessibleHolder* aPluginCOMProxy)
+{
+#if defined(MOZ_CONTENT_SANDBOX)
+  // We don't actually want the accessible object for aHwnd, but rather the
+  // one that belongs to its child (see HTMLWin32ObjectAccessible).
+  HWND childWnd = ::GetWindow(reinterpret_cast<HWND>(aHwnd), GW_CHILD);
+  if (!childWnd) {
+    return IPC_FAIL(this, "GetWindow failed");
+  }
+
+  IAccessible* rawAccPlugin = nullptr;
+  HRESULT hr = ::AccessibleObjectFromWindow(childWnd, OBJID_WINDOW,
+                                            IID_IAccessible,
+                                            (void**)&rawAccPlugin);
+  if (FAILED(hr)) {
+    // This might happen if the plugin doesn't handle WM_GETOBJECT properly.
+    // We should not consider that a failure.
+    return IPC_OK();
+  }
+
+  aPluginCOMProxy->Set(IAccessibleHolder::COMPtrType(rawAccPlugin));
+
+  return IPC_OK();
+#else
+  return IPC_FAIL(this, "Message unsupported in this build configuration");
+#endif
+}
+
 #endif // defined(XP_WIN)
 
 } // a11y

accessible/ipc/DocAccessibleParent.h

@@ -146,6 +146,9 @@ public:
 #if defined(XP_WIN)
   virtual mozilla::ipc::IPCResult RecvCOMProxy(const IAccessibleHolder& aCOMProxy,
                                                IAccessibleHolder* aParentCOMProxy) override;
+
+  virtual mozilla::ipc::IPCResult RecvGetWindowedPluginIAccessible(
+      const WindowsHandle& aHwnd, IAccessibleHolder* aPluginCOMProxy) override;
 #endif
 
 private:

accessible/ipc/win/PDocAccessible.ipdl

@@ -8,6 +8,7 @@ include protocol PFileDescriptorSet;
 include protocol PBrowser;
 
 using mozilla::a11y::IAccessibleHolder from "mozilla/a11y/COMPtrTypes.h";
+using mozilla::WindowsHandle from "ipc/IPCMessageUtils.h";
 
 namespace mozilla {
 namespace a11y {
@@ -61,6 +62,9 @@ parent:
    */
   async BindChildDoc(PDocAccessible aChildDoc, uint64_t aID);
 
+  sync GetWindowedPluginIAccessible(WindowsHandle aHwnd)
+    returns (IAccessibleHolder aPluginCOMProxy);
+
   // For now we'll add the command to send the proxy here. This might move to
   // PDocAccessible constructor in PBrowser.
   sync COMProxy(IAccessibleHolder aDocCOMProxy)

accessible/windows/msaa/HTMLWin32ObjectAccessible.cpp

@@ -62,6 +62,25 @@ HTMLWin32ObjectAccessible::HTMLWin32ObjectAccessible(void* aHwnd,
 {
   mHwnd = aHwnd;
   if (mHwnd) {
+#if defined(MOZ_CONTENT_SANDBOX)
+    if (XRE_IsContentProcess()) {
+      DocAccessibleChild* ipcDoc = aDoc->IPCDoc();
+      MOZ_ASSERT(ipcDoc);
+      if (!ipcDoc) {
+        return;
+      }
+
+      IAccessibleHolder proxyHolder;
+      if (!ipcDoc->SendGetWindowedPluginIAccessible(
+              reinterpret_cast<uintptr_t>(mHwnd), &proxyHolder)) {
+        return;
+      }
+
+      mCOMProxy.reset(proxyHolder.Release());
+      return;
+    }
+#endif
+
     // The plugin is not windowless. In this situation we use 
     // use its inner child owned by the plugin so that we don't get
     // in an infinite loop, where the WM_GETOBJECT's get forwarded
@@ -76,6 +95,14 @@ HTMLWin32ObjectAccessible::HTMLWin32ObjectAccessible(void* aHwnd,
 void
 HTMLWin32ObjectAccessible::GetNativeInterface(void** aNativeAccessible)
 {
+#if defined(MOZ_CONTENT_SANDBOX)
+  if (XRE_IsContentProcess()) {
+    RefPtr<IAccessible> addRefed = mCOMProxy.get();
+    addRefed.forget(aNativeAccessible);
+    return;
+  }
+#endif
+
   if (mHwnd) {
     ::AccessibleObjectFromWindow(static_cast<HWND>(mHwnd),
                                  OBJID_WINDOW, IID_IAccessible,

accessible/windows/msaa/HTMLWin32ObjectAccessible.h

@@ -8,6 +8,10 @@
 
 #include "BaseAccessibles.h"
 
+#if defined(MOZ_CONTENT_SANDBOX)
+#include "mozilla/mscom/Ptr.h"
+#endif
+
 struct IAccessible;
 
 namespace mozilla {
@@ -55,6 +59,9 @@ public:
 
 protected:
   void* mHwnd;
+#if defined(MOZ_CONTENT_SANDBOX)
+  mscom::ProxyUniquePtr<IAccessible> mCOMProxy;
+#endif
 };
 
 } // namespace a11y