From ff425fa6c1d78d61b05a5a9ffe9d99755d8305d8 Mon Sep 17 00:00:00 2001
From: Bill McCloskey <billm@mozilla.com>
Date: Tue, 14 Jul 2015 08:47:21 -0700
Subject: [PATCH] Bug 1100602 - Kill child if accessibility ID is re-used
 (r=trevor)

---
 accessible/ipc/DocAccessibleParent.cpp | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/accessible/ipc/DocAccessibleParent.cpp b/accessible/ipc/DocAccessibleParent.cpp
index 33ee2371894..e2429ba39b0 100644
--- a/accessible/ipc/DocAccessibleParent.cpp
+++ b/accessible/ipc/DocAccessibleParent.cpp
@@ -67,6 +67,11 @@ DocAccessibleParent::AddSubtree(ProxyAccessible* aParent,
     return 0;
   }
 
+  if (mAccessibles.Contains(newChild.ID())) {
+    NS_ERROR("ID already in use");
+    return 0;
+  }
+
   auto role = static_cast<a11y::role>(newChild.Role());
   ProxyAccessible* newProxy =
     new ProxyAccessible(newChild.ID(), aParent, this, role);