diff --git a/accessible/generic/DocAccessible.cpp b/accessible/generic/DocAccessible.cpp index d8449c92850..edf2618a225 100644 --- a/accessible/generic/DocAccessible.cpp +++ b/accessible/generic/DocAccessible.cpp @@ -456,7 +456,7 @@ DocAccessible::Shutdown() // XXX thinking about ordering? if (IPCAccessibilityActive()) { - DocAccessibleChild::Send__delete__(mIPCDoc); + mIPCDoc->Shutdown(); MOZ_ASSERT(!mIPCDoc); } diff --git a/accessible/ipc/DocAccessibleChild.cpp b/accessible/ipc/DocAccessibleChild.cpp index 36c743eaf1a..914200a165e 100644 --- a/accessible/ipc/DocAccessibleChild.cpp +++ b/accessible/ipc/DocAccessibleChild.cpp @@ -70,6 +70,9 @@ DocAccessibleChild::IdToAccessible(const uint64_t& aID) const if (!aID) return mDoc; + if (!mDoc) + return nullptr; + return mDoc->GetAccessibleByUniqueID(reinterpret_cast(aID)); } diff --git a/accessible/ipc/DocAccessibleChild.h b/accessible/ipc/DocAccessibleChild.h index b7bca4f93f4..c2654558b5d 100644 --- a/accessible/ipc/DocAccessibleChild.h +++ b/accessible/ipc/DocAccessibleChild.h @@ -32,10 +32,21 @@ public: { MOZ_COUNT_CTOR(DocAccessibleChild); } ~DocAccessibleChild() { - mDoc->SetIPCDoc(nullptr); + // Shutdown() should have been called, but maybe it isn't if the process is + // killed? + MOZ_ASSERT(!mDoc); + if (mDoc) + mDoc->SetIPCDoc(nullptr); MOZ_COUNT_DTOR(DocAccessibleChild); } + void Shutdown() + { + mDoc->SetIPCDoc(nullptr); + mDoc = nullptr; + SendShutdown(); + } + void ShowEvent(AccShowEvent* aShowEvent); /* diff --git a/accessible/ipc/DocAccessibleParent.cpp b/accessible/ipc/DocAccessibleParent.cpp index 4fb44336b90..4f67b9e759e 100644 --- a/accessible/ipc/DocAccessibleParent.cpp +++ b/accessible/ipc/DocAccessibleParent.cpp @@ -8,6 +8,7 @@ #include "nsAutoPtr.h" #include "mozilla/a11y/Platform.h" #include "ProxyAccessible.h" +#include "mozilla/dom/TabParent.h" namespace mozilla { namespace a11y { @@ -186,6 +187,18 @@ DocAccessibleParent::ShutdownAccessibles(ProxyEntry* entry, void*) return PL_DHASH_REMOVE; } +bool +DocAccessibleParent::RecvShutdown() +{ + Destroy(); + + if (!static_cast(Manager())->IsDestroyed()) { + return PDocAccessibleParent::Send__delete__(this); + } + + return true; +} + void DocAccessibleParent::Destroy() { diff --git a/accessible/ipc/DocAccessibleParent.h b/accessible/ipc/DocAccessibleParent.h index 9e424455a1c..1a6b2c83e41 100644 --- a/accessible/ipc/DocAccessibleParent.h +++ b/accessible/ipc/DocAccessibleParent.h @@ -59,6 +59,7 @@ public: mParentDoc = nullptr; } + virtual bool RecvShutdown() override; void Destroy(); virtual void ActorDestroy(ActorDestroyReason aWhy) override { diff --git a/accessible/ipc/PDocAccessible.ipdl b/accessible/ipc/PDocAccessible.ipdl index 13e8fdb963f..d67fa02e9c3 100644 --- a/accessible/ipc/PDocAccessible.ipdl +++ b/accessible/ipc/PDocAccessible.ipdl @@ -48,7 +48,7 @@ prio(normal upto high) sync protocol PDocAccessible manager PBrowser; parent: - __delete__(); + Shutdown(); /* * Notify the parent process the document in the child process is firing an @@ -67,6 +67,8 @@ parent: BindChildDoc(PDocAccessible aChildDoc, uint64_t aID); child: + __delete__(); + // Accessible prio(high) sync State(uint64_t aID) returns(uint64_t states); prio(high) sync Name(uint64_t aID) returns(nsString name);