Bug 1231919 - crash in mozilla::a11y::DocAccessible::ValidateARIAOwned, r=davidb

This commit is contained in:
Alexander Surkov 2015-12-14 12:02:23 -05:00
parent ec0fba6505
commit 41b5e92c36
2 changed files with 3 additions and 2 deletions

View File

@ -858,7 +858,7 @@ public:
bool IsDefunct() const { return mStateFlags & eIsDefunct; }
/**
* Return true if the accessible is no longer in the document.
* Return false if the accessible is no longer in the document.
*/
bool IsInDocument() const { return !(mStateFlags & eIsNotInDocument); }

View File

@ -1983,7 +1983,8 @@ DocAccessible::ValidateARIAOwned()
nsTArray<RefPtr<Accessible> >* children = it.UserData();
// Owner is about to die, put children back if applicable.
if (!owner->IsInDocument()) {
if (!mAccessibleCache.GetWeak(reinterpret_cast<void*>(owner)) ||
!owner->IsInDocument()) {
PutChildrenBack(children, 0);
it.Remove();
continue;