Bug 1463962 - crash near null in [@ mozilla::a11y::DocAccessible::BindToDocument], r=jamie a=pascalc
authorAlexander Surkov <surkov.alexander@gmail.com>
Wed, 26 Sep 2018 12:06:57 +0800
changeset 490099 6b249c4d451ec409bcc794120d5b1612b634289e
parent 490098 a26549487b5880ca571da70ac2280d149ee74d96
child 490100 98b0d7c2955dca38f13dbebbbafaad02d89f22a8
push id9907
push userapavel@mozilla.com
push dateFri, 28 Sep 2018 14:47:40 +0000
treeherdermozilla-beta@98b0d7c2955d [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersjamie, pascalc
bugs1463962
milestone63.0
Bug 1463962 - crash near null in [@ mozilla::a11y::DocAccessible::BindToDocument], r=jamie a=pascalc
accessible/base/nsAccessibilityService.cpp
accessible/tests/crashtests/1463962.html
accessible/tests/crashtests/crashtests.list
--- a/accessible/base/nsAccessibilityService.cpp
+++ b/accessible/base/nsAccessibilityService.cpp
@@ -1072,17 +1072,19 @@ nsAccessibilityService::CreateAccessible
     // display:contents element doesn't have a frame, but retains the semantics.
     // All its children are unaffected.
     if (content->IsElement() && content->AsElement()->IsDisplayContents()) {
       const HTMLMarkupMapInfo* markupMap =
         mHTMLMarkupMap.Get(content->NodeInfo()->NameAtom());
       if (markupMap && markupMap->new_func) {
         RefPtr<Accessible> newAcc =
           markupMap->new_func(content->AsElement(), aContext);
-        document->BindToDocument(newAcc, aria::GetRoleMap(content->AsElement()));
+        if (newAcc) {
+          document->BindToDocument(newAcc, aria::GetRoleMap(content->AsElement()));
+        }
         return newAcc;
       }
       return nullptr;
     }
 
     if (aIsSubtreeHidden && !frame)
       *aIsSubtreeHidden = true;
 
new file mode 100644
--- /dev/null
+++ b/accessible/tests/crashtests/1463962.html
@@ -0,0 +1,4 @@
+<style>
+#a { display: contents }
+</style>
+<li id="a">
--- a/accessible/tests/crashtests/crashtests.list
+++ b/accessible/tests/crashtests/crashtests.list
@@ -1,13 +1,14 @@
 load 448064.xhtml # This test instantiates a11y, so be careful about adding tests before it
 load 471493.xul
 asserts-if(!browserIsRemote,2) load 884202.html
 load 890760.html
 load 893515.html
 load 1072792.xhtml
 load 1380199.html
 load 1402999.html
+load 1463962.html
 load 1484778.html
 
 # last_test_to_unload_testsuite.xul MUST be the last test in the list because it
 # is responsible for shutting down accessibility service affecting later tests.
 load last_test_to_unload_testsuite.xul