Bug 1231919 - crash in mozilla::a11y::DocAccessible::ValidateARIAOwned, r=davidb

This commit is contained in:
Alexander Surkov 2015-12-14 12:02:23 -05:00
parent ec0fba6505
commit 41b5e92c36
2 changed files with 3 additions and 2 deletions

View File

@ -858,7 +858,7 @@ public:
bool IsDefunct() const { return mStateFlags & eIsDefunct; } bool IsDefunct() const { return mStateFlags & eIsDefunct; }
/** /**
* Return true if the accessible is no longer in the document. * Return false if the accessible is no longer in the document.
*/ */
bool IsInDocument() const { return !(mStateFlags & eIsNotInDocument); } bool IsInDocument() const { return !(mStateFlags & eIsNotInDocument); }

View File

@ -1983,7 +1983,8 @@ DocAccessible::ValidateARIAOwned()
nsTArray<RefPtr<Accessible> >* children = it.UserData(); nsTArray<RefPtr<Accessible> >* children = it.UserData();
// Owner is about to die, put children back if applicable. // Owner is about to die, put children back if applicable.
if (!owner->IsInDocument()) { if (!mAccessibleCache.GetWeak(reinterpret_cast<void*>(owner)) ||
!owner->IsInDocument()) {
PutChildrenBack(children, 0); PutChildrenBack(children, 0);
it.Remove(); it.Remove();
continue; continue;