Merge pull request #7832 from brave/ie_a11y_crash

13837: Fix yet another a11y crash by properly checking a string range.

Author: iefremov

chromium_src/ui/accessibility/platform/ax_platform_node_mac.mm

@@ -8,8 +8,10 @@
 
 // Assumed to be a temporary fix for
 // https://github.com/brave/brave-browser/issues/13778
+// and
+// https://github.com/brave/brave-browser/issues/13837
 #define BRAVE_ACCESSIBILITY_ATTRIBUTED_STRING_FOR_RANGE             \
-  id value = [self getAXValueAsString];                             \
+  id value = [self AXValue];                                        \
   if (![value isKindOfClass:[NSString class]]) {                    \
     ax::mojom::Role role = _node->GetData().role;                   \
     base::debug::Alias(&role);                                      \
@@ -19,6 +21,12 @@
                << " Name: " << _node->GetName();                    \
     base::debug::DumpWithoutCrashing();                             \
     return nil;                                                     \
+  }                                                                 \
+  NSString* str = value;                                            \
+  if (range.location == NSNotFound ||                               \
+      range.location + range.length > str.length) {                 \
+    base::debug::DumpWithoutCrashing();                             \
+    return nil;                                                     \
   }
 
 #include "../../../../ui/accessibility/platform/ax_platform_node_mac.mm"