Code: void fillWidgetStates(AXObject& axObject,
                      protocol::Array<AXProperty>& properties) {
  AccessibilityRole role = axObject.roleValue();
  if (roleAllowsChecked(role)) {
    AccessibilityButtonState checked = axObject.checkboxOrRadioValue();
    switch (checked) {
      case ButtonStateOff:
        properties.addItem(
            createProperty(AXWidgetStatesEnum::Checked,
                           createValue("false", AXValueTypeEnum::Tristate)));
        break;
      case ButtonStateOn:
        properties.addItem(
            createProperty(AXWidgetStatesEnum::Checked,
                           createValue("true", AXValueTypeEnum::Tristate)));
        break;
      case ButtonStateMixed:
        properties.addItem(
            createProperty(AXWidgetStatesEnum::Checked,
                           createValue("mixed", AXValueTypeEnum::Tristate)));
        break;
    }
  }

  AccessibilityExpanded expanded = axObject.isExpanded();
  switch (expanded) {
    case ExpandedUndefined:
      break;
    case ExpandedCollapsed:
      properties.addItem(createProperty(
          AXWidgetStatesEnum::Expanded,
          createBooleanValue(false, AXValueTypeEnum::BooleanOrUndefined)));
      break;
    case ExpandedExpanded:
      properties.addItem(createProperty(
          AXWidgetStatesEnum::Expanded,
          createBooleanValue(true, AXValueTypeEnum::BooleanOrUndefined)));
      break;
  }

  if (role == ToggleButtonRole) {
    if (!axObject.isPressed()) {
      properties.addItem(
          createProperty(AXWidgetStatesEnum::Pressed,
                         createValue("false", AXValueTypeEnum::Tristate)));
     } else {
       const AtomicString& pressedAttr =
           axObject.getAttribute(HTMLNames::aria_pressedAttr);
      if (equalIgnoringCase(pressedAttr, "mixed"))
         properties.addItem(
             createProperty(AXWidgetStatesEnum::Pressed,
                            createValue("mixed", AXValueTypeEnum::Tristate)));
      else
        properties.addItem(
            createProperty(AXWidgetStatesEnum::Pressed,
                           createValue("true", AXValueTypeEnum::Tristate)));
    }
  }

  if (roleAllowsSelected(role)) {
    properties.addItem(
        createProperty(AXWidgetStatesEnum::Selected,
                       createBooleanValue(axObject.isSelected())));
  }

  if (roleAllowsModal(role)) {
    properties.addItem(createProperty(AXWidgetStatesEnum::Modal,
                                      createBooleanValue(axObject.isModal())));
  }
}

Vulnerability Type: Exec Code 
CWE ID: CWE-254
Summary: Google Chrome before 44.0.2403.89 does not ensure that the auto-open list omits all dangerous file types, which makes it easier for remote attackers to execute arbitrary code by providing a crafted file and leveraging a user's previous *Always open files of this type* choice, related to download_commands.cc and download_prefs.cc.
Commit Message: Switch to equalIgnoringASCIICase throughout modules/accessibility

BUG=627682

Review-Url: https://codereview.chromium.org/2793913007
Cr-Commit-Position: refs/heads/master@{#461858}