From 1def7d87c49bb51383b4ad295726da0a8d56df2b Mon Sep 17 00:00:00 2001 From: Trevor Saunders Date: Fri, 6 Nov 2015 15:17:40 -0500 Subject: [PATCH] bug 1221551 - unbind child documents before rebinding them r=davidb It seems possible that a child document could be bound to a parent document without first being unbound. Some evidence for this being possible is that OuterDocAccessible::InsertChildAt() explicitly checks for this and does something similar if it already has a child. --- accessible/ipc/DocAccessibleParent.cpp | 1 + accessible/ipc/DocAccessibleParent.h | 5 ++++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/accessible/ipc/DocAccessibleParent.cpp b/accessible/ipc/DocAccessibleParent.cpp index 6ddefb0362a..dc0831d344d 100644 --- a/accessible/ipc/DocAccessibleParent.cpp +++ b/accessible/ipc/DocAccessibleParent.cpp @@ -206,6 +206,7 @@ DocAccessibleParent::RecvBindChildDoc(PDocAccessibleParent* aChildDoc, const uin MOZ_DIAGNOSTIC_ASSERT(CheckDocTree()); auto childDoc = static_cast(aChildDoc); + childDoc->Unbind(); bool result = AddChildDoc(childDoc, aID, false); MOZ_ASSERT(result); MOZ_DIAGNOSTIC_ASSERT(CheckDocTree()); diff --git a/accessible/ipc/DocAccessibleParent.h b/accessible/ipc/DocAccessibleParent.h index 80402f979e8..1b2720fd8bb 100644 --- a/accessible/ipc/DocAccessibleParent.h +++ b/accessible/ipc/DocAccessibleParent.h @@ -64,7 +64,10 @@ public: void Unbind() { mParent = nullptr; - ParentDoc()->mChildDocs.RemoveElement(this); + if (DocAccessibleParent* parent = ParentDoc()) { + parent->mChildDocs.RemoveElement(this); + } + mParentDoc = nullptr; }