Bug 1861902: Enforce some table restrictions to avoid crashes and improve consistency. a=RyanVM

1. Never treat a cell in a nested CachedTableAccessible as a cell in the outer table. This could previously result in trying to use cache data from one CachedTableAccessible when querying another, which could cause crashes.
2. Don't create an HTMLTableRowAccessible when the <tr> has a valid ARIA role other than "row". This could previously result in a situation where <tr role="grid"> was treated as a row by its parent table, but the <tr> was also treated as a separate table.

Original Revision: https://phabricator.services.mozilla.com/D192175

Differential Revision: https://phabricator.services.mozilla.com/D196001

accessible/base/CachedTableAccessible.cpp

@@ -249,6 +249,11 @@ CachedTableCellAccessible* CachedTableCellAccessible::GetFrom(
     if (auto cellIdx = cachedTable->mAccToCellIdx.Lookup(aAcc)) {
       return &cachedTable->mCells[*cellIdx];
     }
+    // We found a table, but it doesn't know about this cell. This can happen
+    // if a cell is outside of a row due to authoring error. We must not search
+    // ancestor tables, since this cell's data is not valid there and vice
+    // versa.
+    break;
   }
   return nullptr;
 }

accessible/base/HTMLMarkupMap.h

@@ -393,6 +393,13 @@ MARKUPMAP(
         // A <tr> within a row isn't valid.
         return nullptr;
       }
+      const nsRoleMapEntry* roleMapEntry = aria::GetRoleMap(aElement);
+      if (roleMapEntry && roleMapEntry->role != roles::NOTHING &&
+          roleMapEntry->role != roles::ROW) {
+        // There is a valid ARIA role which isn't "row". Don't treat this as an
+        // HTML table row.
+        return nullptr;
+      }
       // Check if this <tr> is within a table. We check the grandparent because
       // it might be inside a rowgroup. We don't specifically check for an HTML
       // table because there are cases where there is a <tr> inside a

accessible/tests/browser/e10s/browser_caching_table.js

@@ -504,3 +504,29 @@ addAccessibleTask(
   },
   { chrome: true, topLevel: true }
 );
+
+/**
+ * Verify that we don't crash for authoring error like <tr role="grid">.
+ */
+addAccessibleTask(
+  `
+<table id="table">
+  <tr><th>a</th></tr>
+  <tr role="grid"><td id="b">b</td></tr>
+</table>
+  `,
+  async function (browser, docAcc) {
+    const table = findAccessibleChildByID(docAcc, "table", [
+      nsIAccessibleTable,
+    ]);
+    is(table.rowCount, 1, "table rowCount correct");
+    is(table.columnCount, 1, "table columnCount correct");
+    const b = findAccessibleChildByID(docAcc, "b");
+    let queryOk = false;
+    try {
+      b.QueryInterface(nsIAccessibleTableCell);
+      queryOk = true;
+    } catch (e) {}
+    ok(!queryOk, "No nsIAccessibleTableCell on invalid cell b");
+  }
+);