Bug 1246447 - crash in mozilla::a11y::DocAccessible::ARIAAttributeChanged, r=yzen
authorAlexander Surkov <surkov.alexander@gmail.com>
Thu, 04 Aug 2016 10:49:21 -0400
changeset 308273 66256409133057d37962b8aaeed02532f8883f5d
parent 308272 1b3f240f813835f4495451f6abe08f9482289eb3
child 308274 79b119d86a4ccd9b567fc079f016f03004ec749a
push id30531
push usercbook@mozilla.com
push dateFri, 05 Aug 2016 10:01:39 +0000
treeherdermozilla-central@d320ef56876f [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersyzen
bugs1246447
milestone51.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1246447 - crash in mozilla::a11y::DocAccessible::ARIAAttributeChanged, r=yzen
accessible/generic/DocAccessible.cpp
--- a/accessible/generic/DocAccessible.cpp
+++ b/accessible/generic/DocAccessible.cpp
@@ -759,16 +759,21 @@ DocAccessible::AttributeChanged(nsIDocum
   Accessible* accessible = GetAccessible(aElement);
   if (!accessible) {
     if (mContent != aElement)
       return;
 
     accessible = this;
   }
 
+  if (!accessible->IsBoundToParent()) {
+    MOZ_ASSERT_UNREACHABLE("DOM attribute change on accessible detached from tree");
+    return;
+  }
+
   // Fire accessible events iff there's an accessible, otherwise we consider
   // the accessible state wasn't changed, i.e. its state is initial state.
   AttributeChangedImpl(accessible, aNameSpaceID, aAttribute);
 
   // Update dependent IDs cache. Take care of accessible elements because no
   // accessible element means either the element is not accessible at all or
   // its accessible will be created later. It doesn't make sense to keep
   // dependent IDs for non accessible elements. For the second case we'll update